I have one user account that I do not have in any groups. I want to
keep
it that way. I want allow them ONLY 1 web site.

I created a ALLOW rule to access to the one site.

I also created a DENY rule to deny ALL others.

I have the ALLOW ABOVE the DENY.

For some reason if I have the DENY rule it blocks the one web site I
want
access to.

If I have ONLY the allow rule they can access ANYTHING since they are
NOT
in a group.

What am I doing wrong.