firewall: move DMZ rule to the end of queue