Write the rules. Order matters.
A firewall checks each packet against its rules from the top and stops at the first match. Write the rules, watch the traffic arrive, then set an alarm for what gets through.
Write a rule, then check.
If nothing matches, the default policy decides.
How this works: a packet-filter firewall looks at the source address, protocol and port of each packet. Rules run top to bottom and the first match wins. It is a model of that idea, not a real firewall: there is no connection tracking, content scanning or real traffic, and the addresses are documentation examples. The alarm counts failed logins from one address in any 10 ticks.