It's interesting that in 2022 we still have network issues caused by wrong order of rules.
Everybody at one time experiences the dreaded REJECT not being at the end of the rule stack but just too early.
Kudos to CF for such a good explanation of what caused the issue.