First, the background. The ONLY way that I've been able to avoid choppy audio in the uplink direction is to turn on QoS AND set restricted bandwidth (currently set to 130K). Now it works perfectly. As I understand it, and my experiments have shown, to use those settings the Obi must be in router mode, not bridge mode. My DSL modem is a combination router / modem so to avoid a double-NAT, I set the DSL router in bridge mode and turned on the Obi firewall.
To check for open WAN ports, I ran GRC Shields Up scanner and guess what, port 80 is wide open, even with the setting device Administration > Web Server > AccessfromWAN unchecked. Toggling the check box with a reboot between made no difference. For kicks, I moved the web server to port 8000 and ran the scan again. GRC reported port 80 is now closed but port 8000 is open.
Is this a bug? How can I close the web server port to the outside world but leave it open for admin behind the firewall?