I even removed the whole firewall extension, reinstalled and configured it from scratch. Installation was done from the standard update / add modules plesk panel -> no change. I have to call
/opt/psa/var/modules/firewall/firewall-active.sh
after reboot. This is in fact a SEVERY SECURITY HOLE...