First match wins, and order is the whole game
A packet filter reads its list from the top and stops at the first rule that matches; nothing below that line is ever considered. That is why a broad allow sitting above a narrow deny quietly defeats it, and why the same four rules can permit or drop identical traffic depending only on their order. Anything that reaches the bottom without matching hits the implicit deny, which is why a working rule-set always ends with what you meant to permit, not what you forgot to block.
Learn the idea behind the lab
This lab is the practice; Firewalls & ACLs explains the model behind it.