ACL control: how does it work?

Hi! Squider,

    Today I tried to figure out how to use ACL control but no luck success.
    Here is what I did:

    acl all src 0.0.0.0/0.0.0.0
    acl dislike src 123.234.0.0/16

    http_access deny dislike
    icp_access deny dislike

    http_access allow all
    icp_access allow all

    But after squid run up, the deny list is useless, everybody still could
    access my proxy. So, I thought maybe it is "last match first use", so I
    try to put "allow" first and then "deny", but fail too.

    The only way I success is use "http_access allow !dislike all", but I
    don't want like this cause it is hard to control if I want to allow
    some of the C class IP in "dislike" can use it. For example, I add a
    new acl as:

    acl dislike_but_ok src 123.234.11.0/24

    Then I want to deny "dislike" but allow "dislike_but_ok", how should I
    configure it ?

    Your info will be appreciated.

--
Alex Lau