IP filter list doesn't seem to get populated for containers

[vshab]

Hello, so I have hit a bit of a problem with recently learned software defined networking

I created DHCP zone and network by following tutorial from wiki (Setup Simple Zone With SNAT and DHCP)
After that I changed network config of existing LXC containers to use newly created VNet with DHCP IP address setup, but hit an issue where containers can't use internet at all unless I turn off firewall. After a bit of "scientific research" I narrowed it down to IP filter. Then I checked iptables (with ping-flooding) and well, it led me to ! match-set PVEFW-101-ipfilter-net0-v4 src rule.

Following text wall is a part of iptables -L -v -n

Chain veth101i0-OUT (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 PVEFW-SET-ACCEPT-MARK  17   --  *      *       0.0.0.0/0            0.0.0.0/0           [goto]  udp spt:68 dpt:67
    0     0 DROP       0    --  *      *       0.0.0.0/0            0.0.0.0/0            MAC ! bc:24:11:xx:xx:xx
  716  204K DROP       0    --  *      *       0.0.0.0/0            0.0.0.0/0            ! match-set PVEFW-101-ipfilter-net0-v4 src
    0     0 MARK       0    --  *      *       0.0.0.0/0            0.0.0.0/0            MARK and 0x7fffffff
    0     0 PVEFW-SET-ACCEPT-MARK  0    --  *      *       0.0.0.0/0            0.0.0.0/0           [goto]
    0     0            0    --  *      *       0.0.0.0/0            0.0.0.0/0            /* PVESIG:xxxxxxxxxxxxxxxxxxxxxxx */

Then I used ipset list PVEFW-101-ipfilter-net0-v4 to see if this list is incorrect...

Name: PVEFW-101-ipfilter-net0-v4
Type: hash:net
Revision: 7
Header: family inet hashsize 64 maxelem 64 bucketsize 12 initval 0xc0819f69
Size in memory: 456
References: 1
Number of entries: 0
Members:

...and, it's empty?

Did I do something wrong? Why is this list empty, when I suppose it shouldn't be this way?​

^ VNet I created in case it is needed, let me know if more info is needed
+ Proxmox Virtual Environment 8.2.7
+ bare metal

(also P.S.: I believe that I hit same issue on another proxmox instance as well while moving everything from old "DIY" SNAT bridge, same symptoms of net not working with firewall etc.)