Writing firewall rules: order, first match, and shadowing

The previous lesson established default deny. Once several rules sit on the same interface, the open question is which one actually decides a packet's fate: that is the whole point of evaluation order. Rules on an interface are read in…