Your webserver control application should have settings to accept unsolicited Inbound traffic to certain ports (probably 80, 443, etc… based on its usage), and with certain protocols. Presuming you have those ports already established, and that disabling CFP (presumably you’re changing the Security Level to Allow All) lets it work properly, here’s what you will need to do…
Open Network Monitor.
Right-click the top-position rule (ID 0), select Add/Add Before.
Build the rule as:
Action: Allow (and log, if you want to keep track of who’s accessing your server)
Protocol: TCP/UDP (whichever you need, or both)
Direction: In
Source IP: Any
Destination IP: your external static IP address for the webserver
Source Port: Any
Destination Port: A Set of Ports: the ports you need, ie 80,443,25,110 (no spaces)