The firewall for App Engine is pretty simple. It contains a list of rules for allowing or denying traffic to your application from a specific IP range. Note that the rules apply to all the resources of the application. The rules are ordered by priority, with a value of 1 being the most important and 2147483647 being the least important:
The default rule, which allows all traffic from all IP ranges, has the lowest priority and is always evaluated at the end.