The first matching row supplies the action.

highlighted = computed this step

Stop at the first match

Rule 2 is the first matching row, so its action is used.

winner row=2\text{winner row}=2
First match winsThe ordered firewall table is recomputed from the pinned tuple and pinned rules.First matching firewall rule - 192.168.1.10:40000 -> 203.0.113.5:443, winner allow-web allowruleprotosourcedestinationdportactionmatchwinnerdecisiondeny-sshTCP0.0.0.0/00.0.0.0/022denynonoskipallow-webTCP192.168.1.0/24203.0.113.5/32443allowyesyesallowdefault-denyany0.0.0.0/00.0.0.0/0anydenyyesnonot reached

A later broad row is not the winner

The default row also matches broadly, but it is later than the winning row and is not reached.

default row match=1\text{default row match}=1
First match winsThe ordered firewall table is recomputed from the pinned tuple and pinned rules.First matching firewall rule - 192.168.1.10:40000 -> 203.0.113.5:443, winner allow-web allowruleprotosourcedestinationdportactionmatchwinnerdecisiondeny-sshTCP0.0.0.0/00.0.0.0/022denynonoskipallow-webTCP192.168.1.0/24203.0.113.5/32443allowyesyesallowdefault-denyany0.0.0.0/00.0.0.0/0anydenyyesnonot reached

The chosen action is allow

The winning row is allow-web, so this toy decision allows the tuple.

winner row=2\text{winner row}=2
First match winsThe ordered firewall table is recomputed from the pinned tuple and pinned rules.First matching firewall rule - 192.168.1.10:40000 -> 203.0.113.5:443, winner allow-web allowruleprotosourcedestinationdportactionmatchwinnerdecisiondeny-sshTCP0.0.0.0/00.0.0.0/022denynonoskipallow-webTCP192.168.1.0/24203.0.113.5/32443allowyesyesallowdefault-denyany0.0.0.0/00.0.0.0/0anydenyyesnonot reached

Summary

First match means a later broad deny row does not override the earlier matching allow row.

winner row=2\text{winner row}=2
First match winsThe ordered firewall table is recomputed from the pinned tuple and pinned rules.First matching firewall rule - 192.168.1.10:40000 -> 203.0.113.5:443, winner allow-web allowruleprotosourcedestinationdportactionmatchwinnerdecisiondeny-sshTCP0.0.0.0/00.0.0.0/022denynonoskipallow-webTCP192.168.1.0/24203.0.113.5/32443allowyesyesallowdefault-denyany0.0.0.0/00.0.0.0/0anydenyyesnonot reached