It is recommended that sites using the Windows Firewall should open the firewall to the LISTSERV program.  This is the preferred method as it makes it easy to change various TCP/IP-related aspects of LISTSERV's operation (e.g., outbound mail port, TCPGUI port) without having to change the firewall.

For the SMTPL.EXE "listener", it is recommended to open the firewall on port 25 from all IP addresses.  Alternately, simply open the firewall to the appropriate program.  The only advantage to explicitly opening port 25 as opposed to opening the firewall to SMTPL.EXE or some other specific MTA program is that you can easily switch from SMTPL to another MTA or vice versa without having to worry about changing the firewall settings.  Port 25 is also a "well-known" port so inbound mail is in almost every case going to come to port 25, regardless of which program is listening on that port for LISTSERV's mail.