I haven’t tried it and I’m not using sys-tor for firewalling purposes. Generally speaking, I think it’s good to separate concerns and have a dedicated firewall VM, like sys-torfw for example, which uses sys-tor as netvm and implements firewalling (and nothing else). But maybe using sys-tor as firewall too just works out of the box. I’d be curious to know if you test it.
answered here: Guide for disposable sys-whonix replacement? - #10 by rabla