OK - JB to the rescue again.
He saw I was marking my allowed IPs as Local - FreePBX doesn't know the 4445 service, so it's not allowed to be part of Local as far as the firewall is concerned.
So two options exist -
mark allowed IPs as Trusted, not Local create a custom service under the firewall, and set it as a local service, then IPs marked as Local will get access.Thanks @JaredBusch