I have been create a LXC container with enabled 'firewall' (attached image) and all other options by default(!). My VM.fw next:
root@pve:~# cat /etc/pve/firewall/120.fw
[OPTIONS]
enable: 1
Now, i am checking firewall rules for interfaces in this VM:
exists veth120i0-IN...