seems the only solution is to manually enable the built-in WF rule to allow TCP 3389 on TermService before installing FF.
I came from WFC, uninstalled and restored WF rules to default. In Hyper-V VM, I made "termservice" trackable and have the corresponding program...
Separate names with a comma.