Firewalls allow or deny traffic by rule
A firewall checks each flow against an ordered list of rules matching source, destination, protocol, and port. The first matching rule wins; if none match, the default policy applies. A default-deny firewall blocks everything not explicitly allowed - the safe posture.
Order matters
Because the first match wins, rule order changes behaviour. A broad deny above a specific allow will block the traffic you meant to permit. Put specific rules first, general ones last.
Segmentation
Good security blocks the specific dangerous path, not everything. Denying 'guest subnet → admin server' isolates guests from internal systems while still letting them reach the internet and letting staff reach admin. That's segmentation done right.