Firewall rule shadowing makes the app port reachable from one segment only

An allow rule was added for the correct service, but an earlier broader rule still matches first on another path and blocks the flow unexpectedly.