Allow/Deny - Which over-rides?

[snootalope]

Let's say I have a statement on my firewall that says allow any external address access to an internal http server. That works fine.

Now say I add a host to a deny all ip statement. That client wouldn't be able to access the above http service would it?

 

[iggsterman]

First matching ACL line will be used. If the "deny ip" line is _below_ the "permit tcp" for your http server then HTTP will continue working.