Using Squid as a reverse cache proxy, need to give access only to clients whose IP addresses are from particular netblocks: acl service dstdomain .foo.com acl clients src 123.45.67.89/255.255.255.128 http_access deny service all http_access allow service clients What may be the possible reason that clients with IP addresses not from that netblock can still access the service?