Sounds like ZoneAlarm to me. I use it too, and get those same questions now and then - for instance, whenever
UO is patched it asks whether or not to allow the
UO client to act as server, and to accept connections from the net.
I always accept these and tell ZoneAlarm to remember the setting. What "act as server" means is allowing the program to send information to the net upon request - accepting connections from the net being self-explanatory. So these two things just mean allowing the program to accept and send information. Perfectly normal as far as I know.