Can't configure firewall properly in NVG589

I'm trying to set up the firewall in the Arris NVG589 and apparently don't understand how it works.  I've set up a number of ingress WAN "pass" rules based on ports in the packet filter.  I only want to allow inbound on these ports (80, 433, 20-21, etc.).  At the end of the list I created a "drop" rule for all ingress WAN traffic.  But when I enable the drop rule, I can't access any web sites or remote into any of my cloud servers.  What am I missing?

Rules look like:

IP Version IPv4 or IPv6
Ingress Interface of WAN

Protocol of TCP

Destination Port of xxxx