All input to the internet interface will be directed to a chain of filters. Ports which are accepted are open. Also all ports from 1024 and above are open (these ports will be used for local access toward internet). Any active services in this range which are not accepted will be explicitly denied.
Any new service which is activated in the system later on will be inaccessible from the internet until the corresponding port is opened.
However, if a new service is activated in the port range above 1024 it will be possible to access it until the firewall is rebuilt. Just enter the dialog and click on OK and this will be done.