I want to allow access to facebook during lunch but block it the rest of the day. I also want to block a host of other urls all day. I set up the keyword objects and create 2 keyword object groups - always and timed. I created 2 url filters to block using the keygroups called AlwaysBlocked and TimedBlock. I set up the schedules I wanted and then set the rules in the default filter in the firewall. If the "Timed" is first then facebook is blocked correctly and allowed at lunch but nothing else is blocked all day (the next rule is ignored). If Always is first (i.e. it is rule 2 and Timed is now rule 3) then everything gets blocked except facebook all day (the next rule is ignored). I tried changing from "Pass if no further match" to "Pass immediately" - no change. "Block Immediately" and "Block if no further match" give no access to the url filters. It seems as though you can not combine url filters. The url filters use "Both:Block". All filters and rules show enabled. Can anyone help. Routers tried 2920 and 2830 with up-to-date firmware.

sounds like a bug.. email support for help

Original post is from 2011. It's 2015 and I'm having the exact same issue. Only the first rule applies.
I'm guessing this couldn't have been a bug for so long, but a bad user-side configuration instead.
So: Does anybody has any pointers on how this SHOULD be done?

It's how the URL filter / firewall works - if a filter rule links to a URL filter, that's the one it process, it's not possible to link onto a second URL filter rule. So the rule to block facebook would need to have all sites that would normally be blocked plus facebook in the URL filter.