Indeed, applying a firstmakes traffic from rx bypass the firewall as rx would then forwardtraffic to r1 via its direct link.
