My guess: post-firewall is executed until the first error. You remove DROPALL rule then add something, then restore DROPALL. It means that in case of the break during execution your firewall is in the state ALLOWALL. I'd suggest to issue iptables -P INPUT DROP close to the beginning of the file instead of the last DROPALL line. And of course debug your post-firewall by ether manual execution (while providinge required parameters), or add 'logger ...' commands to check untill which point you really reach on execution
