A newer pfSense will also give you access to the latest version pfBlockerng.
Your issue might auto solve itself.

thanks for the kind words on blocklist-manager, glad it's useful!

By the way, I like what you're doing with your blocklist-manager tool.

Additionally (and with the default setting there)—if for whatever reason you need a pass rule above pfBlockerNG's auto-added block rules, then the way to do that would be by way of the "Permit" feed group action options (i.e., actions "Permit Inbound" for WAN interface/s, "Permit Outbound" for LAN interface/s, or "Permit Both"). This would be the cleanest and most automated way to "whitelist" any pfBlockerNG false positives.

Thanks, I'll check with the default setting.
If that solves the reordering problem, the script is still useful as a general safety net for rule ordering, but the main reason here was clearly misconfiguration on my part.

So then why not use the default setting which leaves "All other rules" unaffected by pfBlockerNG?

Firewall 'Auto' Rule Order

my issue was specifically manual rules getting reordered relative to each other

This wouldn't be caused by pfBlockerNG's cron job. The order of non-pfBlockerNG auto-added rules (i.e., 'manual rules') could only be changed manually.

What do you have for that package setting—"Firewall > pfBlockerNG > IP > IP Interface/Rules Configuration > Firewall 'Auto' Rule Order"?

There are package settings which address auto-added rule ordering. Do those not cover your situation?

I looked at the pfBlockerNG rule order settings but they control where pfBlockerNG places its own auto rules relative to manual ones, not the order of manual rules themselves.
my issue was specifically manual rules getting reordered relative to each other, so those settings didn't help in my case.

Regarding my version, yes, i know. i'm in the process of replacing the pfsense box.

Ditto for any LAN interfaces ..

Initially, I listed that one as well. But I spotted something strange, so I withdrew it.
So here it is :

After years of rule building ( I was in the past also a fan of "every packet needs its own rule", but then I found the cure and live was good again) I found rule number 3 and 4.
I added a final block all rule, but this one could never match, as the perfect rules 3 and 4 exist.
Still : rule 5 matches ones in a while 'something'. After a 'everything' there shouldn't be a 'something'.
Right ?

pfSense always adds new rules to the bottom of the list. Every time you add one and forget to drag it to the right position, your security policy silently breaks.

Good policy, if applied, can't be broken (it wouldn't be good to start with).
Let me explain with my 'policy' WAN rules :

You see the last two rules ? These are the final 'block all' rules, separated for IPv6 and IPv4.
And yes, these two rules are the same as the 'hidden' default behavior : block all.

So, if you wanted to add a new WAN pass rule, it would be inserted at the bottom, being completely inoffensive. As soon as you see it, you have to drag it to to correct place, and save. Forgetting to do so won't get you fired. Policies won't get broken

@ngf said in pfsense-rule-order: script to keep firewall rules in the right order automatically:

Tested on pfSense CE 2.7.2.

Now you are breaking one of the most important security rules. 2.7.2 was good, and now 'ancient'.

pfSense always adds new rules to the bottom of the list

not it doesn't