I attempted to add a "default deny" rule that included zero condition clauses to the packet filter. This fails, so my workaround is to add a Source Address of "0.0.0.0/0". I post this in case there are any other Untangle newbs out there :-), and also because it seems odd that the rule wasn't applied in the case where all zero conditions matched!