Data packets are inspected and passed/blocked in the following order:

DoS Defence -> Firewall -> NAT