Suricata

drop tcp [10.0.0.0/16] any -> any any (flow: to_server, established; sid:1;)
pass tls any any -> any any (ssl_state:client_hello; tls.sni; content:"google.com"; dotprefix; nocase; flow: to_server, established; sid:2;)

If on the client hello packet both rules match, the drop action is applied to the packet. However since the match of sid 1 isn't terminating, the flow action from sid 2 is also applied.

I broadly see 2 options:
- just stop after the first drop match
- deconflict, so if a drop rule matched first, ignore pass rules