id: 27 is more specific than id: 25444, but still how could this be detected as a violation when the connection is already in allow list?