Subnet access control

The firewall rule default setting is any any or any deny?

Can create the rule like this?

src=172.16.1.1/24 , dst=192.168.1.1/24,action=deny, port/application=tcp3389,tcp22

any process sequence of the firewall rule?