Hi Frederic, Sorry for starting an similar topic, but I have been confused about the 'yellow arrow' for a long time and wonder if you can give some advices. I understand that: Normally, this yellow arrow is set in 99.99% cases. In this case, when a packet matches all criteria of a rule, lns applies the rule to this packet immediately, whatever the following rules. The question confusing me is that: If I change the 'yellow arrow' to a 'dot', theoretically, lns should continue to match the following rules, even if it has found a matched rule in the ruleset. A very simple example: Rule 1: block 139 (turn off 'yellow arrow') Rule 2: allow 139 (turn on 'yellow arrow') In this case, if a inbounding packet with the destination port 139 is received, Rule 1 matches, LnS should block this packet. But, since 'yellow arrow' is NOT checked, LnS will continue to match the following rules with this packet. LnS then matches Rule 2. This packet matches Rule 2 exactly again. But, rule 2 is an allowing rule. So, Should LnS allow this packet? Logically, It should (because the 'yellow arrow' of rule 1 is cleared) I hope I have expressed my question clearly. Any help would be greatly appreciated. thanks in advance.