IPFW: IP blocked, but still can get in
It is because rules are followed from top to bottom. As soon as the first matching rules is found, further rule processing stops.

In this case there is first the allow rule (12304 allow tcp from any to any dst-port 80) and later the deny rule (12407 deny tcp from 94.23.148.61 to 192.168.1.3 dst-port 80,443).

To fix this: either place the deny rule above the allow rule for port 80 and 442 (number &lt; 12304) or place the allow rules for port 80 and 443 below the deny rules (f.e. at 65533 and 65534).