Rule Order — a firewall ruleset is a sequence, not a set

Same five rules, same network, every time. Only their order changes. The firewall reads top to bottom and stops at the first rule that matches, so where a rule sits decides what it means — and whether it means anything at all.

What the office asked for pc1 · 10.1.1.2 (inside) · firewall · pc2 .1.2.3 · pc3 .1.2.4 · pc4 .1.2.5 (outside)

The FORWARD chain

Move a rule with ▲ ▼. The firewall stops at the first match, so a rule sitting below something broader than itself is never consulted.

What actually happens

—