tksysv, by default, assigns ipchains a priority of 8 on startup and 92 on
shutdown. But network is 10/90, and ipchains can't be started until the
network is up.
Ipchains SHOULD be started before the network card is brought up.
Establishing chains has nothing to do with bringing the net up unless you're
doing something like putting hostnames in your -s or -d fields.
If you take your chains off before you have shutdown then there is small moment
when you are open to a compromise.
If you turn them on AFTER you're up then the same is true.
that is too much of a risk for a lot of people.