I noticed hosts in the iptables fpbxhosts chain that I didn't put there. Investigation found that fpbx is automatically putting any hosts specified in /etc/hosts into fpbxhosts as trusted.
Code looks to be at in /var/www/html/admin/modules/firewall/bin/getservices) but comments do not say why this is done:
// Grab /etc/hosts and make sure that every host in there is added
// to the trusted zone