How to limit traffic between ports - RB450

I’ve set up an RB450 as an internet router:
port 1 - internet
port 2 - 192.168.100.x subnet gw
I’d like to set up port 3 to allow internet access for a public wireless network:
port 3 - 10.95.10.x subnet gw

What’s the best way to limit access from port 3 to port 2 to given ports on a server on port 2’s subnet? I’m able to get internet access for the port 3 subnet, but can’t properly limit access from the port 3 subnet to the port 2 subnet (I can only get “all or nothing access”).
TIA,
Mike

Nevermind - got it sorted. The order a given set of firewall rules is in is important… :confused: