Firewall rules persist on disk but reboot restores an older iptables view

An admin saves working firewall rules, reboots, and finds the old behavior back even though the config file never changed.