Each ordered row is tested against the same packet tuple.
Rows are checked from top to bottom
The firewall tests the first row, then the next row, using the same tuple fields each time.
rule rows=3
The first row misses the port
The first row wants destination port 22, but the tuple destination port is 443.
The second row matches
The second row matches TCP, the source prefix, the destination prefix, and destination port 443.
match row=2
Summary
The table records which rows match, but the winner is still the first matching row.
matches=2