Allowing Subnets - Cloudflare

[aeminkocal]

Hello,
I want to allow only the traffic coming from and going to cloudflare.

I have created the rules and the ipset. The ipset has cloudflare IP subnets but Proxmox Firewall seems to recognize them as singular ip addresses. I need this ip list to be treated as whole subnets.
What should I do?

Edit:
Here is the firewall config:


I can ping 1.1.1.1 but not the ips on the ip list (above)

Edit:
Found the problem, there was a priority of rules.

 

[mira]

If you set the default policy to `Drop`, you don't have to add those `Drop` rules