NSX Bridge forwarding traffic, regardless of firewall rules

We have NSX running in one of our customer's environments. Version 4.1.1. Some physical resources are also installed, so we have created some bridge networks to route physical devices through NSX for firewalling etc.

There is a firewall rule in the Gateway Firewall section, connected to the Tier-0 router, that is supposed to block traffic from a certain VLAN to other VLANs. The same rule is also created in the Distributed Firewall. When I connect a device to the VLAN, I can still reach other networks that should be blocked, and I don't see any hits on the firewall.

Anybody got an idea what I am doing wrong? It could be I just don't understand at what point the firewall rules are applied... BTW, the traffic we are trying to block is forwarded from the Tier-0 gateway to the upstream router.