VMware Server vs. Host Firewall

If your VM is hosting a web server in bridged network mode, if you are using the Windows version of VMware Server, other than the usual hole-poking in the VM's OS's own firewall, you have to also allow inbound stream on port 80 on the VM host even though it has a completely different IP address. Talk about counterintuitive.