The most specific rule (based on the length of the path argument) wins when resolving
Disallow: conflicts - regardless of the order of the directives in the file. So, for the given URL, the first rule wins because it is the most specific path that matches the requested URL.
To resolve this you can either make the
Disallow: directive more specific (ie. longer), for example:
Or, simply remove the
Allow: directive altogether, since allow is the default action. So, all you would seem to need is:
A URL of the form
/services/online.html would be implicitly allowed since it doesn't contain a query string that starts