diff --git a/test/ipt/objects-for-regression-tests.fwb b/test/ipt/objects-for-regression-tests.fwb
index c3e93ba57..74e2110ff 100644
--- a/test/ipt/objects-for-regression-tests.fwb
+++ b/test/ipt/objects-for-regression-tests.fwb
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="10" lastModified="1218555343" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="10" lastModified="1218562459" id="root">
   <Library id="sysid99" name="Deleted Objects" ro="False">
     <ICMP6Service id="idE0C27650" name="ipv6 dest unreachable" comment="No route to destination" code="0" type="1"/>
     <IPv4 id="id41D295E2" name="firewall30:ppp.200*:ip" address="192.168.1.1" netmask="255.255.255.0"/>
@@ -591,6 +591,11 @@
     <ServiceRef ref="id43EC877332486"/>
     <ServiceRef ref="id449328D924380"/>
     <ObjectRef ref="sysid0"/>
+    <ObjectRef ref="id43BB817E9745"/>
+    <ObjectRef ref="id43BB80919745"/>
+    <ObjectRef ref="id43BB80919745"/>
+    <ObjectRef ref="id43BB817C9745"/>
+    <ObjectRef ref="sysid0"/>
   </Library>
   <Library id="syslib001" name="User" comment="User defined objects" color="#d2ffd0">
     <ObjectGroup id="stdid01_1" name="Objects">
@@ -19244,7 +19249,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="verify_interfaces">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id43BB80919745" name="firewall37" comment="testing TAG and CLASSIFY rules&#10;&#10;normal script mode (not using  iptables-restore)" host_OS="linux24" inactive="False" lastCompiled="1215360268" lastInstalled="1142003872" lastModified="1218555343" platform="iptables" ro="False" version="">
+      <Firewall id="id43BB80919745" name="firewall37" comment="testing TAG and CLASSIFY rules&#10;&#10;normal script mode (not using  iptables-restore)" host_OS="linux24" inactive="False" lastCompiled="1215360268" lastInstalled="1142003872" lastModified="1218562459" platform="iptables" ro="False" version="">
         <NAT id="id43BB80B09745" name="NAT" ipv6_rule_set="False" top_rule_set="True">
           <NATRule id="id43BB814D9745" disabled="False" position="0">
             <OSrc neg="False">
@@ -19385,7 +19390,214 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="tagobject_id">id43EC877332486</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43BBCC139745" action="Tag" direction="Both" disabled="False" log="True" position="5">
+          <PolicyRule id="id43501X5007" action="Tag" direction="Outbound" disabled="False" group="" log="False" position="5">
+            <Src neg="False">
+              <ObjectRef ref="id43BB817E9745"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id3CB1279B"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="id43BB817C9745"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="action_on_reject"></Option>
+              <Option name="color">#C0BA44</Option>
+              <Option name="rule_name_accounting"></Option>
+              <Option name="tagobject_id">id43EC877332486</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id43518X5007" action="Tag" direction="Outbound" disabled="False" group="" log="False" position="6">
+            <Src neg="False">
+              <ObjectRef ref="id43BB817C9745"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id3CB1279B"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="id43BB817C9745"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="action_on_reject"></Option>
+              <Option name="color">#C0BA44</Option>
+              <Option name="rule_name_accounting"></Option>
+              <Option name="tagobject_id">id43EC877332486</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id43535X5007" action="Tag" direction="Outbound" disabled="False" group="" log="False" position="7">
+            <Src neg="False">
+              <ObjectRef ref="id43BB80919745"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id3CB1279B"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="id43BB817C9745"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="action_on_reject"></Option>
+              <Option name="color">#C0BA44</Option>
+              <Option name="rule_name_accounting"></Option>
+              <Option name="tagobject_id">id43EC877332486</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id43554X5007" action="Tag" direction="Outbound" disabled="False" group="" log="False" position="8">
+            <Src neg="False">
+              <ObjectRef ref="id43BB817E9745"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id3CB1279B"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="id43BB817C9745"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="action_on_reject"></Option>
+              <Option name="color">#C0BA44</Option>
+              <Option name="connlimit_masklen">0</Option>
+              <Option name="connlimit_value">0</Option>
+              <Option name="firewall_is_part_of_any_and_networks">False</Option>
+              <Option name="hashlimit_burst">0</Option>
+              <Option name="hashlimit_dstlimit">False</Option>
+              <Option name="hashlimit_expire">0</Option>
+              <Option name="hashlimit_gcinterval">0</Option>
+              <Option name="hashlimit_max">0</Option>
+              <Option name="hashlimit_mode_dstip">False</Option>
+              <Option name="hashlimit_mode_dstport">False</Option>
+              <Option name="hashlimit_mode_srcip">False</Option>
+              <Option name="hashlimit_mode_srcport">False</Option>
+              <Option name="hashlimit_name"></Option>
+              <Option name="hashlimit_size">0</Option>
+              <Option name="hashlimit_suffix"></Option>
+              <Option name="hashlimit_value">0</Option>
+              <Option name="limit_burst">0</Option>
+              <Option name="limit_suffix"></Option>
+              <Option name="limit_value">0</Option>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="rule_name_accounting"></Option>
+              <Option name="stateless">True</Option>
+              <Option name="tagobject_id">id43EC877332486</Option>
+              <Option name="ulog_nlgroup">1</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id43571X5007" action="Tag" direction="Outbound" disabled="False" group="" log="False" position="9">
+            <Src neg="False">
+              <ObjectRef ref="id43BB817C9745"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id3CB1279B"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="id43BB817C9745"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="action_on_reject"></Option>
+              <Option name="color">#C0BA44</Option>
+              <Option name="connlimit_masklen">0</Option>
+              <Option name="connlimit_value">0</Option>
+              <Option name="firewall_is_part_of_any_and_networks">False</Option>
+              <Option name="hashlimit_burst">0</Option>
+              <Option name="hashlimit_dstlimit">False</Option>
+              <Option name="hashlimit_expire">0</Option>
+              <Option name="hashlimit_gcinterval">0</Option>
+              <Option name="hashlimit_max">0</Option>
+              <Option name="hashlimit_mode_dstip">False</Option>
+              <Option name="hashlimit_mode_dstport">False</Option>
+              <Option name="hashlimit_mode_srcip">False</Option>
+              <Option name="hashlimit_mode_srcport">False</Option>
+              <Option name="hashlimit_name"></Option>
+              <Option name="hashlimit_size">0</Option>
+              <Option name="hashlimit_suffix"></Option>
+              <Option name="hashlimit_value">0</Option>
+              <Option name="limit_burst">0</Option>
+              <Option name="limit_suffix"></Option>
+              <Option name="limit_value">0</Option>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="rule_name_accounting"></Option>
+              <Option name="stateless">True</Option>
+              <Option name="tagobject_id">id43EC877332486</Option>
+              <Option name="ulog_nlgroup">1</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id43588X5007" action="Tag" direction="Outbound" disabled="False" group="" log="False" position="10">
+            <Src neg="False">
+              <ObjectRef ref="id43BB80919745"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id3CB1279B"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="id43BB817C9745"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="action_on_reject"></Option>
+              <Option name="color">#C0BA44</Option>
+              <Option name="connlimit_masklen">0</Option>
+              <Option name="connlimit_value">0</Option>
+              <Option name="firewall_is_part_of_any_and_networks">False</Option>
+              <Option name="hashlimit_burst">0</Option>
+              <Option name="hashlimit_dstlimit">False</Option>
+              <Option name="hashlimit_expire">0</Option>
+              <Option name="hashlimit_gcinterval">0</Option>
+              <Option name="hashlimit_max">0</Option>
+              <Option name="hashlimit_mode_dstip">False</Option>
+              <Option name="hashlimit_mode_dstport">False</Option>
+              <Option name="hashlimit_mode_srcip">False</Option>
+              <Option name="hashlimit_mode_srcport">False</Option>
+              <Option name="hashlimit_name"></Option>
+              <Option name="hashlimit_size">0</Option>
+              <Option name="hashlimit_suffix"></Option>
+              <Option name="hashlimit_value">0</Option>
+              <Option name="limit_burst">0</Option>
+              <Option name="limit_suffix"></Option>
+              <Option name="limit_value">0</Option>
+              <Option name="log_level"></Option>
+              <Option name="log_prefix"></Option>
+              <Option name="rule_name_accounting"></Option>
+              <Option name="stateless">True</Option>
+              <Option name="tagobject_id">id43EC877332486</Option>
+              <Option name="ulog_nlgroup">1</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id43BBCC139745" action="Tag" direction="Both" disabled="False" log="True" position="11">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
@@ -19409,7 +19621,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="tagobject_id">id43EC877332486</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4665E24F7765" action="Tag" direction="Both" disabled="False" log="False" position="6">
+          <PolicyRule id="id4665E24F7765" action="Tag" direction="Both" disabled="False" log="False" position="12">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -19432,7 +19644,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="tagobject_id">id43EC877332486</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43BBCC3D9745" action="Tag" direction="Inbound" disabled="False" log="False" position="7">
+          <PolicyRule id="id43BBCC3D9745" action="Tag" direction="Inbound" disabled="False" log="False" position="13">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -19455,7 +19667,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="tagobject_id">id43EC877332486</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id459E471C10946" action="Tag" direction="Outbound" disabled="False" log="False" position="8">
+          <PolicyRule id="id459E471C10946" action="Tag" direction="Outbound" disabled="False" log="False" position="14">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -19478,7 +19690,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="tagobject_id">id43EC877332486</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4483A4BD1810" comment="using CONNMARK" action="Tag" direction="Both" disabled="False" log="False" position="9">
+          <PolicyRule id="id4483A4BD1810" comment="using CONNMARK" action="Tag" direction="Both" disabled="False" log="False" position="15">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -19507,7 +19719,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="tagobject_id">id342984</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4483A4CE1810" comment="using CONNMARK" action="Tag" direction="Both" disabled="False" log="True" position="10">
+          <PolicyRule id="id4483A4CE1810" comment="using CONNMARK" action="Tag" direction="Both" disabled="False" log="True" position="16">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -19536,7 +19748,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="tagobject_id">id342984</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4483A4DF1810" comment="using CONNMARK" action="Tag" direction="Both" disabled="False" log="True" position="11">
+          <PolicyRule id="id4483A4DF1810" comment="using CONNMARK" action="Tag" direction="Both" disabled="False" log="True" position="17">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
@@ -19566,7 +19778,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="tagobject_id">id342984</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4483A4F01810" comment="using CONNMARK" action="Tag" direction="Inbound" disabled="False" log="False" position="12">
+          <PolicyRule id="id4483A4F01810" comment="using CONNMARK" action="Tag" direction="Inbound" disabled="False" log="False" position="18">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -19595,7 +19807,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="tagobject_id">id342984</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id459E472D10946" comment="using CONNMARK" action="Tag" direction="Outbound" disabled="False" log="False" position="13">
+          <PolicyRule id="id459E472D10946" comment="using CONNMARK" action="Tag" direction="Outbound" disabled="False" log="False" position="19">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -19624,7 +19836,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="tagobject_id">id342984</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43BB80989745" action="Pipe" direction="Both" disabled="False" log="False" position="14">
+          <PolicyRule id="id43BB80989745" action="Pipe" direction="Both" disabled="False" log="False" position="20">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -19644,7 +19856,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43BB81879745" action="Classify" direction="Both" disabled="False" log="False" position="15">
+          <PolicyRule id="id43BB81879745" action="Classify" direction="Both" disabled="False" log="False" position="21">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -19679,7 +19891,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id451E2B486383" action="Classify" direction="Both" disabled="False" log="True" position="16">
+          <PolicyRule id="id451E2B486383" action="Classify" direction="Both" disabled="False" log="True" position="22">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -19714,7 +19926,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id451E56936383" action="Classify" direction="Both" disabled="False" log="False" position="17">
+          <PolicyRule id="id451E56936383" action="Classify" direction="Both" disabled="False" log="False" position="23">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
@@ -19750,7 +19962,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id451E56A46383" action="Classify" direction="Both" disabled="False" log="True" position="18">
+          <PolicyRule id="id451E56A46383" action="Classify" direction="Both" disabled="False" log="True" position="24">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
@@ -19786,7 +19998,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id451EAD596383" action="Classify" direction="Both" disabled="False" log="False" position="19">
+          <PolicyRule id="id451EAD596383" action="Classify" direction="Both" disabled="False" log="False" position="25">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -19821,7 +20033,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id451EAD6A6383" action="Classify" direction="Both" disabled="False" log="True" position="20">
+          <PolicyRule id="id451EAD6A6383" action="Classify" direction="Both" disabled="False" log="True" position="26">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -19856,7 +20068,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id451ED8E76383" action="Classify" direction="Both" disabled="False" log="False" position="21">
+          <PolicyRule id="id451ED8E76383" action="Classify" direction="Both" disabled="False" log="False" position="27">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -19891,7 +20103,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id451ED8F86383" action="Classify" direction="Both" disabled="False" log="True" position="22">
+          <PolicyRule id="id451ED8F86383" action="Classify" direction="Both" disabled="False" log="True" position="28">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -19926,7 +20138,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="ulog_nlgroup">1</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4599A9DC19324" comment="testing for bug #1618381&#10;classify action is non-terminating&#10;in this firewall object" action="Classify" direction="Both" disabled="False" log="False" position="23">
+          <PolicyRule id="id4599A9DC19324" comment="testing for bug #1618381&#10;classify action is non-terminating&#10;in this firewall object" action="Classify" direction="Both" disabled="False" log="False" position="29">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -19968,7 +20180,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id4599A9E919324" comment="second rule for bug #1618381" action="Classify" direction="Both" disabled="False" log="False" position="24">
+          <PolicyRule id="id4599A9E919324" comment="second rule for bug #1618381" action="Classify" direction="Both" disabled="False" log="False" position="30">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -20010,7 +20222,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id459A026219324" comment="testing for bug #1618381" action="Classify" direction="Both" disabled="False" log="False" position="25">
+          <PolicyRule id="id459A026219324" comment="testing for bug #1618381" action="Classify" direction="Both" disabled="False" log="False" position="31">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
@@ -20053,7 +20265,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id459A5AFB19324" comment="testing for bug #1618381" action="Classify" direction="Both" disabled="False" log="False" position="26">
+          <PolicyRule id="id459A5AFB19324" comment="testing for bug #1618381" action="Classify" direction="Both" disabled="False" log="False" position="32">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
@@ -20097,7 +20309,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id459A875F19324" comment="bug #1618381&#10;this rule uses multiport&#10;and has to be split because&#10;of that" action="Classify" direction="Both" disabled="False" log="False" position="27">
+          <PolicyRule id="id459A875F19324" comment="bug #1618381&#10;this rule uses multiport&#10;and has to be split because&#10;of that" action="Classify" direction="Both" disabled="False" log="False" position="33">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -20140,7 +20352,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43F46B8A28368" action="Custom" direction="Both" disabled="False" log="False" position="28">
+          <PolicyRule id="id43F46B8A28368" action="Custom" direction="Both" disabled="False" log="False" position="34">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -20168,7 +20380,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="tagvalue"></Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43495X28575" action="Branch" direction="Both" disabled="False" group="" log="True" position="29">
+          <PolicyRule id="id43495X28575" action="Branch" direction="Both" disabled="False" group="" log="True" position="35">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -20211,7 +20423,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id43BB80A49745" action="Deny" direction="Both" disabled="False" log="True" position="30">
+          <PolicyRule id="id43BB80A49745" action="Deny" direction="Both" disabled="False" log="True" position="36">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>