Self-signed certificates don't prevent MITM attacks on connecting unless you've transmitted the certificate securely out-of-band and installed it in the client's browser. (which practically never happens with sites on the open internet) They only prevent tampering with the connection once it's established.

The browser should jump up and down when encountering such a certificate as it's exactly how an attempted MITM attack would look.