Rules are checked in order from top to bottom. On real devices, the first matching rule wins and the rest are skipped, so a broad allow or deny placed too early can silently override rules below it. Use the up and down buttons to reorder.