We say a packet matches a rule if the packet’s source address is in the rule’s source range and destination in the destination range, in which case the decision is applied to that packet. If a packet matches both a block and allow rule, the block rule ‘wins’ and the packet is blocked. Let’s use a simple firewall with two rules, an allow rule and a block rule.