It may be (and by default is) path relative to VM directory. This code will be gone in the final version, after merging firewall configuration into qubes.xml. But for now have something testable.