A firewall receives a packet that PC1 sends to PC2.

The security policy specifies that traffic originating from 12.1.1.2 and destined for the untrust zone is permitted. Since the source address of the packet (12.1.1.1) does not match this rule, the packet matches the default implicit deny rule. However, rule 1 does not deny all other traffic explicitly, so the packet is forwarded based on further configurations ​.