tl-setup now offers to alter the (permanent) firewall configuration. However, if the /etc/init.d/iptables service is stopped, it will be started. This is not what I expect. I expect it to change the on-disk configuration, but nothing else.
Apparently, "lokkit" has a --nostart flag that we could use. We would also need to verify if the iptables service is stopped, though.
*** Bug 5156 has been marked as a duplicate of this bug. ***