When to select 'qubes-firewall' in services tab

[unman]

Do you know it or are you guessing right now? Point is, when I make a fresh install of Qubes and tell it to set up a sys-firewall qube this service is not activated.

Yes, it is.
qubes-firewall is the firewall manager, which takes settings from the
firewall tab in qube manager, or qvm-firewall. It is enabled in
netvms, but not in sys-net.
You can check this with systemctl status qubes-firewall

You don’t need to use the Services tab for this - as it says on that tab,
“Unlisted services will follow default settings” and the default for a
qube that provides network is for the service to be enabled.

I never presume to speak for the Qubes team.
When I comment in the Forum or in the mailing lists I speak for myself.