v0.25.3

src/proxy/forward/route_cache.rs

@@ -1,6 +1,10 @@
 {
 // Both scopes run before DNS, TCP, TLS or reuse of an existing upstream connection.
 if !snapshot.host_allowed(&host, context.client_ip)
+    || !route
+        .profile_acl
+        .as_ref()
+        .is_none_or(|acl| acl.allows(context.client_ip))
     || !route
         .acl
         .as_ref()