At the "set up your firewall" stage of the installer, chose to start from
the high-security firewall (lets through DNS & DHPC).  Go to Custom, and
also let in SSH.  When install is done, notice that DNS doesn't work 
"service ipchains status" prints out the firewall rules: "please let ssh
in, otherwise deny"

From the way the GUI appears (when I chose custom, my "high-medium-none"
choise was not greyed-out), I assumed that I was modifying the rules,
instead of defining them.