Thanks omega, using a deny-all filter and then explicitly allowing the dir that
I really want seems to do the trick. I still can't figure out why the "Can go
down" option doesn't work like that in the first place (to my understanding,
it should), but never mind. Now at least I know one method of doing what I
want, thanks.

(PS Sorry about inadvertently doubleposting my original msg.)