I'm in the progress to migrate a custom fedora-based proxyVM to a debian 9 template,
because debian's longer support cycles.

On my fedora proxyVM I simply disabled
qubes-network and
qubes-firewall
to be in full control of the firewall rules and forwarding.

When I disable these services on the debian template it does not have
the same effect (i.e. /proc/sys/net/ipv4/ip_forward remains 1).

Is this feature
qvm-service proxyvm1 -d qubes-network
qvm-service proxyvm1 -d qubes-firewall
 not supported on debian 9 templates or is it currently broken?

I'm on R3.2.

thanks,
Joonas