@mikepea :  the id ranges are different for each services. 

firewall service => 0-65536,
nat_service => 65537- Xyz