diff --git a/package/gluon-core/luasrc/lib/gluon/upgrade/140-firewall-rules b/package/gluon-core/luasrc/lib/gluon/upgrade/140-firewall-rules
index 5345c1a74c553eab2e535372bc231dede3eef014..ae374e3312546b957a5d95dbbe7dc2d36a2fc146 100755
--- a/package/gluon-core/luasrc/lib/gluon/upgrade/140-firewall-rules
+++ b/package/gluon-core/luasrc/lib/gluon/upgrade/140-firewall-rules
@@ -95,6 +95,7 @@ for _, zone in ipairs({'wired_mesh', 'wan'}) do
 		dest_port = '4789',
 		target = 'ACCEPT',
 	})
+	uci:reorder('firewall', zone .. '_vxlan', 0)
 end