Hi,
A google search led me to: http://reactivated.net/writing_udev_rules.html
There it states that you generally will want your rules before the system default rules, but in any case it should apply all the rules, not only the first match, so putting your rule after the defaults could have some effect.
Also, it seems that the default permissions should be 0660, but for some reason /dev/net/tun is created with 0600, even though there is not setting for that in 50-udev.rules... still don't know why.
One other way that might go around this is to use the "last_rule" option. Apparently, if you add OPTIONS+="last_rule" to the rule it won't process the further down rules, so this might be one way to fix your specific problem.
Another useful information from that webpage is the reference to the "udevtest" command, that I believe could be used to trace exactly what is happening on your case.
Anyway, I still haven't tried any of those. If you do and find out what is happening, please share with us your results!
HTH, Filipe