Why would you include a firewall that, "is not set to block anything"? That doesn't make much sense.
Here's what I can tell you.
I have VMWare / SAVASM running on a live (real) IP Address (not a 192.168.x.x address).
#1 When I use the console to run setup then disable firewall all runs fine. SpamAssassin works fine and I can access web admin. But, the rest of the world could use my SpamAssassin if they found it. I can access the web admin from anywhere. Not something I want.
#2 If I enable the firewall via setup I cannot access web admin and SpamAssassin stops working.
So the firewall does in fact block something.
The question is how to change the firewall to accept my live IP Address instead of the 192.168.x.x range (which I'm not using)? When the firewall is disabled via console you can't configure it inside web admin, and if I enable the firewall I can't access web admin to configure the firewall. Catch 22.
-Joe