Yes. The firewall, VNet, and the public IP address all must be in the same resource group.