I have posted my problem here:
after starting them manually, dynamic firewall works properly.
looks like turris-survey is run by cron:
Dec 6 05:00:01 turris crond[20157]: (root) CMD (/bin/sh -c "source /lib/functions/sentinel.sh; allowed_to_run "survey" && exec turris-survey")