CSF firewal - how does csf.allow work?

Yes you're right, some examples taken from the readme.txt:

# TCP connections inbound to port 3306 from IP 11.22.33.44
tcp:in:d=3306:s=11.22.33.44

# TCP connections outbound to port 22 on IP 11.22.33.44
tcp:out:d=22:d=11.22.33.44

If omitted, the default protocol is set to "tcp", the default connection
direction is set to "in"