Every packet carries a 5-tuple: source IP/port, destination IP/port, and protocol. The firewall walks its rule list from the top, and for each rule tests whether the packet's protocol, source and destination port all satisfy that rule's fields (a field set to "any" always matches). The very first rule that matches decides the packet's fate — allow or deny — and every rule after it is never even consulted for that packet.
for rule in rules (top → bottom):
if proto.matches and src.matches and port.matches:
return rule.action
return DENY // implicit default-deny
- Default-deny — if no rule matches, real firewalls deny by default. Adding an explicit "deny all" at the end only makes that behavior visible; the risk is a rule you needed sitting below it.
- Shadowed rules — a rule is unreachable when an earlier rule already matches everything it would match (e.g. an early "allow any/any/any"). Shadowed rows dim out and are counted in the HUD.
- First-match-wins — order matters more than any single rule's correctness. A narrow, specific rule placed after a broad one never fires.