Firewall rules update problem

I'm having problem sending syslog to my graylog server. Syslog is only sending if i disable firewall on host. Ports 514 and 1514 are enabled in firewall rules.

If firewall is enabled nc -zu graylog-server 514 / 1514 works ok.

Strange thing if I manually edit  services.xml and run esxcli network firewall refresh nothing changes.

Please help