Each ordered row is tested against the same packet tuple.

highlighted = computed this step

Rows are checked from top to bottom

The firewall tests the first row, then the next row, using the same tuple fields each time.

rule rows=3\text{rule rows}=3
Read rows in orderThe ordered firewall table is recomputed from the pinned tuple and pinned rules.First matching firewall rule - 192.168.1.10:40000 -> 203.0.113.5:443, winner allow-web allowruleprotosourcedestinationdportactionmatchwinnerdecisiondeny-sshTCP0.0.0.0/00.0.0.0/022denynonoskipallow-webTCP192.168.1.0/24203.0.113.5/32443allowyesyesallowdefault-denyany0.0.0.0/00.0.0.0/0anydenyyesnonot reached

The first row misses the port

The first row wants destination port 22, but the tuple destination port is 443.

2244322\ne443
Read rows in orderThe ordered firewall table is recomputed from the pinned tuple and pinned rules.First matching firewall rule - 192.168.1.10:40000 -> 203.0.113.5:443, winner allow-web allowruleprotosourcedestinationdportactionmatchwinnerdecisiondeny-sshTCP0.0.0.0/00.0.0.0/022denynonoskipallow-webTCP192.168.1.0/24203.0.113.5/32443allowyesyesallowdefault-denyany0.0.0.0/00.0.0.0/0anydenyyesnonot reached

The second row matches

The second row matches TCP, the source prefix, the destination prefix, and destination port 443.

match row=2\text{match row}=2
Read rows in orderThe ordered firewall table is recomputed from the pinned tuple and pinned rules.First matching firewall rule - 192.168.1.10:40000 -> 203.0.113.5:443, winner allow-web allowruleprotosourcedestinationdportactionmatchwinnerdecisiondeny-sshTCP0.0.0.0/00.0.0.0/022denynonoskipallow-webTCP192.168.1.0/24203.0.113.5/32443allowyesyesallowdefault-denyany0.0.0.0/00.0.0.0/0anydenyyesnonot reached

Summary

The table records which rows match, but the winner is still the first matching row.

matches=2\text{matches}=2
Read rows in orderThe ordered firewall table is recomputed from the pinned tuple and pinned rules.First matching firewall rule - 192.168.1.10:40000 -> 203.0.113.5:443, winner allow-web allowruleprotosourcedestinationdportactionmatchwinnerdecisiondeny-sshTCP0.0.0.0/00.0.0.0/022denynonoskipallow-webTCP192.168.1.0/24203.0.113.5/32443allowyesyesallowdefault-denyany0.0.0.0/00.0.0.0/0anydenyyesnonot reached