Firewall rules in the client area are checked in order, from the top of the list. The first rule that matches the traffic decides what happens, and the rules below it are not checked. If the order is wrong, traffic you want can be blocked, or traffic you don't want can get through.
How the order works
Each rule has a Position. Position 0 is at the top and is checked first.
Each new rule is added at position 0 and moves the others down.
To change the order, drag a rule by the arrows next to its position.
A rule that is switched off is skipped.
Because new rules go to the top, create the rule that blocks everything first and the rules that allow traffic after it. You can also drag the blocking rule to the bottom when you're done.
A blocking rule above your allow rules wins. Nothing below it is checked, so the traffic you allowed is blocked.
Example: ping from one IP address
This example uses ping, because it's easy to test. Three rules were created in this order:
Rule 1: Block all incoming traffic.
Type in, Action REJECT and no Protocol.
Rule 2: Allow ping from one IP address.
Type in, Action ACCEPT, Protocol 1 Internet Control Message Protocol and your own IP address in Source.
Rule 3: Allow ping from everyone.
The same as rule 2, with Source empty.
Each new rule went to the top, so the list ends up in this order:
Position 0: allow ping from everyone
Position 1: allow ping from one IP address
Position 2: block all incoming traffic
What each rule does
Only the blocking rule switched on.
Ping gets no answer from anywhere.
The one-IP rule switched on as well.
Ping works from that IP address and gets no answer from any other.
All three rules switched on.
Ping works from every address. The one-IP rule is no longer needed, because the rule above it already allows everyone.
