When using a service group that contains a protocol (GRE, ESP, etc.) this is not shown in the rule table in the third column. This just states "TCP, UDP" if this are in that service group as well with ESP or GRE missing here.
THis issue is fixed with commits: http://git.ipfire.org/?p=people/amarx/ipfire-2.x.git;a=commit;h=712500d0dcb95a761c528211d23c664bd1033128 and http://git.ipfire.org/?p=people/amarx/ipfire-2.x.git;a=commit;h=0626fac1ac47b506e31cbc59c96ea8811b5d1321