When tl-setup is installing tlclient.cgi and friends ("Web integration"), it should also open port 80 and 443 if it understands how to manipulate the firewall.
Since solving bug 5190, tl-setup does not install the web integration automatically any longer.