@VNick We aren't calling `/usr/local/psa/admin/bin/modules/firewall/rules` directly. We are just following the debug information (It gets called when calling --confirm.). Example you can test:
\pm_ApiCli::call('extension', array('--call', 'firewall', '--confirm')
I still don't understand why...