Without using ipfw. I wanted to have Personal Web Sharing on, but block access to it on the firewall. When I tried to change it in the Firewall tab in System Preferences I got a sheet saying, “You cannot change the firewall settings for this service.” So I went off and found that the settings are stored in
/Library/Preferences/com.apple.sharing.firewall.plist
Once I opened it I discovered I could change the ‘editable’ value:
<key>Personal Web Sharing</key>
<dict>
<key>editable</key>
<integer>0</integer>
<key>enable</key>
<integer>1</integer>
<key>port</key>
<array>
<string>80</string>
I set it to 1, saved it, and re-opened System Preferences Firewall Tab. I could now disable access to port 80 through the firewall, while leaving me free to continue fiddling with my internal website.