The changes should be done in the root image, i.e. in the TemplateVM, otherwise they do not persist as per general Qubes default. Does that answer your question?
sys-whonix - if it is a StandaloneVM - make changes in sys-whonix.
Otherwise if it is TemplateBasedVM (default), then these changes need to be made in the root image, i.e. in the TempalteVM. Otherwise these changes would not persist as per general Qubes default.
In Whonix 13 it will be possible to use /rw/config/whonix_firewall.d/.
Same was discussed here:
Customizing Whonix Firewall / torified dom0 upgrades