I want to put IPMI on a public IP for remote access, so I need to allow only 1 IP to access it. In the IP Access Control the default policy is accept. Does it matter what order the rules are set?
Yes. There are 10 slots available for IP Access Control rules. The ordering matters. For example, if your system is 192.168.1.1, you would put that as Rule 1 and set it to Allow. The second rule would be 0.0.0.0/0 and set to Deny. This will block all IP address that is not your IP of 192.168.1.1.
If you put Rule 1 as 0.0.0.0/0 and Block, then you put your IP as Rule 2 and Allow. This will block all access to the IPMI, since Rule 1 takes precedence over Rule 2 and will block all IP, even though you have Rule 2 set to allow your IP. To recover from this, you need to reset it to factory defaults locally.