Instead of overriding /etc/sysconfig/ip{,6}tables, store qubes rules in /etc/sysconfig/iptables.qubes and configure the service to use that file instead. This will prevent conflict on that file and also handle upgrades.