What @anav tried to write is: routing entity of ROS tries to forward traffic between all connected networks (i.e. those that router has own IP address or knows a suitable gateway). And firewall entity of ROS can prevent connectivity if configured appropriately.
But then there are firewalls on individual devices which might drop any inbound (and most outbound) connections if they originate from “alien” subnets … and this part of non-connectiviry has nothing to do with the way routers/firewalls are configured.