Sorry Slawka, I overlooked that you still run on a PVE 4.x which is no longer supported. I strongly recommend to upgrade your system to the latest version and keep it up to date. Please follow this wiki post to upgrade https://pve.proxmox.com/wiki/Upgrade_from_4.x_to_5.0
Regarding your issue you can of course try to narrow down which files pve-firewall is reading (lsof), log files in general (journalctl) output of `systemctl status pve-firewall`... But I strongly recommend you to upgrade as a first step and see if the issue persists.