tksysv, by default, assigns ipchains a priority of 8 on startup and 92 on shutdown. But network is 10/90, and ipchains can't be started until the network is up.
Ipchains SHOULD be started before the network card is brought up. Establishing chains has nothing to do with bringing the net up unless you're doing something like putting hostnames in your -s or -d fields. If you take your chains off before you have shutdown then there is small moment when you are open to a compromise. If you turn them on AFTER you're up then the same is true. that is too much of a risk for a lot of people.