Region : USA

Model : TL-R600VPN

Hardware Version : V2

Firmware Version : 1.2.2 Build 140530 Rel.35298n

ISP :

I'm trying to use Access Control for one Host on my LAN, and that host has a fixed (non-DHCP) local address. I want that Host to be prevented from making any outbound connections, except to a NTP Time Server. I setup the rules as I'd expect, and they don't work as I'd expect.

I defined the one Host (by its LAN static IP address), and the one time server as Target (by its DNS). Then I created two rules, as in the screenshot.

When I enable the second rule it blocks the Host access to the Time Server - which was intended to be explicitly Allowed by the previous rule. I tried swapping the order of the rules and it still blocks access to the TimeServer.

What's the "correct" form for Access Control rules to allow outbound connections from a Host to a single Target?

Thanks!
John