Works now 
As a source firewall.xxx_int.src I was using an interface name (wifi_interface in my config), what we need is zone name (wi_zone in my case).
If I would have same name for interface and zone it would work, but at least now I know that src is a zone and not interface
Thanks guys!