EDIT: Figured it out - I'm an idiot.
I basically had an 'Allow All' as my last firewall rule that applied to my entire local subnet. I was trying to specify only certain services for firewall rules above for specific devices on my network, but when you remove a Service that those devices need (like DNS), it will simply skip over that firewall rule and end up hitting the last 'Allow All' firewall rule. It got really confusing because my Log Viewer was showing traffic from my Macbook Air hitting the correct firewall rule, but when I ran the policy tester it was showing it using a different firewall rule, but that's exactly what was likely occurring since my Macbook Air was basically using different firewall rules depending on which service(s) it was trying to use.
Basically, if you're moving from an 'Allow All' approach to a 'Deny All' approach, you need to make sure you update your 'Allow All' rule so it only applies to the devices that need to use that rule and remove your local subnet so it doesn't become a "catch all" rule that passes anything that didn't apply to the firewall rules above it.
On a different note, now when I try to run the Policy Test tool, the results are always 'Blocked' and it's showing 'No Matched Rule (ID:0)', even though I'm testing it against IP address of devices that do have a firewall rule they're using to access the website I'm testing against (www.google.com). Any ideas what's causing that?
This thread was automatically locked due to age.
