What are the differences between Firewall rules and Regex and how do they work together?

Question

We have had issues where there was a clean rule for allowing apple traffic yet the traffic was obviously filtered/suppresed. We have a 300Mb pipe and were getting 5Mb downloads. We added regex entries and now have great speed from apple. Is there a doc (I couldnt find anything to explain how they work) that explains the difference between the 2?

This thread was automatically locked due to age.

Michael Dunn · Accepted Answer

Michael Jones1 said: 
 What does regex do that firewall rules don't? 
 
 If you are asking about the two different methods that are in the KB (Exceptions using RegEx versus Firewall Rules). 
 If you use the firewall rule method, the traffic (the packets) are forwarded from the LAN to the WAN, without ever going through the web proxy. 
 If you use the Exception / RegEx rule method the packets are sent the web proxy, the proxy then still implements some policy (other policy may not be run based on the exception) and then sent out to the far web server. 
 
 So an Exception turns off part of the web proxy policy. A firewall rule bypasses the web proxy altogether. 
 
 If you wanted to turn off antivirus scanning and still enforce category blocks, use an exception. If you wanted to say "I fully trust this site and want connections completely untouched" use a firewall rule.

LuCar Toni · Answer

I think this KBA explains your query. 
 https://community.sophos.com/kb/en-us/128173