
Explanation:

* Rule with lower order are applied first.
* We can selectively permit or deny network traffic (in the management portal or from
PowerShell) for a virtual machine input endpoint by creating rules that specify "permit" or
"deny". By default, when an endpoint is created, all traffic is permitted to the endpoint. So for that reason, it's important to understand how to create permit/deny rules and place them in the proper order of precedence to gain granular control over the network traffic that you choose to allow to reach the virtual machine endpoint. Note that at the instant you add one or more "permit" ranges, you are denying all other ranges by default. Moving forward from the first permit range, only packets from the permitted IP range will be able to communicate with the virtual machine endpoint.