Me guessing: could your sys-firewall be disposable by any chance? That would explain the behaviour that you describe.
In an AppVM the /rw directory is persistent. If your sys-firewall was a DispVM, however, that directory would be inherited from the AppVM that acts as the DispVM template. In that case, you’d want to make the changes in that AppVM.
The inheritance behaviour is described in detail in this section of the documentation (Inheritance and persistence):