Solaris: Adding Rules to SunScreen

I already wrote about SunScreen, the firewall you receive with Solaris. I stumbled over a little thing to keep in the back of your head while adding rules to it: the order of the rules is significant!
Not that I didn't know about this, but sometimes in the daily rush one tends to forget or simply not think before typing (the very reason was in not enough coffee/phonecalls coming in/basically being busy doing something completely different/don't ask).
I created a new service for Adobe Document Server:
edit> add SERVICE "altercast" SINGLE FORWARD "tcp" PORT 8019
and created a new rule to use the service:
edit> add rule altercast * self ALLOW LOG SUMMARY COMMENT "adobe altercast access"
I verified the settings with:
edit> verify
Saved them:
edit> save
Left the program and activated the new settings.
Eager to see the admin-interface, I fired up my browser and tried to connect; timeout. The software was running (it starts itself, contrary to the manual). I added the rule, the right port, etc. What is going on? Time for a cup of coffee.
I reopened the SunScreen configuration, checked the service settings for altercast, everything seems to be fine. Then the coffee kicked in and I did:
edit> list rules
1 "ssh" "*" "self" ALLOW LOG SUMMARY COMMENT "allow ssh from everywhere"
2 "ping" "*" "*" ALLOW COMMENT "icmp echo"
3 "netbios" "*" "*" DENY COMMENT "no DOS allowed"
4 "*" "localhost" "*" ALLOW COMMENT "allow outgoing"
5 "*" "*" "self" DENY LOG DETAIL COMMENT "look who is knocking"
6 "altercast" "*" "self" ALLOW LOG SUMMARY COMMENT "altercast traffic"
Rule number five pipes everything not covered by the preceding rules to the trusty /dev/null data-sink, the rule for altercast never fired!
To cut a long story short:
edit> insert rule 4 altercast * self ALLOW LOG SUMMARY COMMENT "adobe altercast access"
edit> list rules
1 "ssh" "*" "self" ALLOW LOG SUMMARY COMMENT "allow ssh from everywhere"
2 "ping" "*" "*" ALLOW COMMENT "icmp echo"
3 "netbios" "*" "*" DENY COMMENT "no DOS allowed"
4 "altercast" "*" "self" ALLOW LOG SUMMARY COMMENT "adobe altercast access"
5 "*" "localhost" "*" ALLOW COMMENT "allow outgoing"
6 "*" "*" "self" DENY LOG DETAIL COMMENT "look who is knocking"
Don't forget to delete the misplaced rule from the rule-set first.
;-)