There have been various reports of problems getting Brickhouse to startup properly in 10.3.9 or later, and the reason for that is twofold, (1) the boot script doesn't write any messages to the console letting you know whether it's starting or not, leading to confusion, and (2) the parameters file doesn't list the proper required services needed to be running before starting the script, causing it to start too early and consequently, the settings get wiped out when the system firewall extension gets loaded. Brickhouse needs to load after the IP Firewall extension loads, not before.

To solve this, your boot script needs to look like this (/Library/StartupItems/Firewall/Firewall):

#!/bin/sh
# Firewall Boot Script
# Generated by BrickHouse

. /etc/rc.common

#===========================================================
# Activate Firewall Filters
#===========================================================

ConsoleMessage "Activating Brickhouse Filters"

/sbin/ipfw -q /etc/firewall.conf

#===========================================================
# Enable IP Firewall Logging
#===========================================================

ConsoleMessage "Enabling Brickhouse Logging"

/usr/sbin/sysctl -w net.inet.ip.fw.verbose=1
/usr/sbin/sysctl -w net.inet.ip.fw.verbose_limit=65535

And your startup parameters file needs to look like this (/Library/StartupItems/Firewall/StartupParameters.plist):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Description</key>
<string>BrickHouse Firewall</string>
<key>Messages</key>
<dict>
<key>start</key>
<string>Activating Firewall</string>
<key>stop</key>
<string>Clearing Firewall</string>
</dict>
<key>OrderPreference</key>
<string>Late</string>
<key>Provides</key>
<array>
<string>Firewall</string>
</array>
<key>Requires</key>
<array>
<string>NetworkExtensions</string>
<string>Resolver</string>
<string>Super Server</string>
</array>
</dict>
</plist>

For the record, the Messages key in the parameters file has been deprecated by Apple and doesn't do anything, which is why normally you can't even tell if the rules have been applied. The addition of the ConsoleMessage commands in the actual script remedies that.

After making the changes and rebooting, you should now be able to look at the system.log and see if Brickhouse has loaded properly.

While Brickhouse is a great product, it's plain sloppy of the developer not to have corrected this by now.