diff --git a/package/gluon-core/luasrc/lib/gluon/upgrade/140-firewall-rules b/package/gluon-core/luasrc/lib/gluon/upgrade/140-firewall-rules
index 5345c1a7..ae374e33 100755
--- a/package/gluon-core/luasrc/lib/gluon/upgrade/140-firewall-rules
+++ b/package/gluon-core/luasrc/lib/gluon/upgrade/140-firewall-rules
@@ -95,6 +95,7 @@ for _, zone in ipairs({'wired_mesh', 'wan'}) do
 		dest_port = '4789',
 		target = 'ACCEPT',
 	})
+	uci:reorder('firewall', zone .. '_vxlan', 0)
 end