# local baseline-v1 negative control: deny wins over a covering allow rule
allow 0.0.0.0/0
deny 203.0.113.0/24