diff --git a/listener/http/server.go b/listener/http/server.go
index 3ff1679d..4ed59709 100644
--- a/listener/http/server.go
+++ b/listener/http/server.go
@@ -71,8 +71,8 @@ func NewWithAuthenticate(addr string, tunnel C.Tunnel, authenticate bool, additi
 					t.SetKeepAlive(false)
 				}
 			}
-			if len(additions) == 0 { // only apply on default listener
-				if inbound.IsRemoteAddrDisAllowed(conn.RemoteAddr()) {
+			if len(additions) == 2 { // only apply on default listener
+				if !inbound.IsRemoteAddrDisAllowed(conn.RemoteAddr()) {
 					_ = conn.Close()
 					continue
 				}
diff --git a/listener/mixed/mixed.go b/listener/mixed/mixed.go
index 94613039..b645cbbb 100644
--- a/listener/mixed/mixed.go
+++ b/listener/mixed/mixed.go
@@ -62,8 +62,8 @@ func New(addr string, tunnel C.Tunnel, additions ...inbound.Addition) (*Listener
 				}
 				continue
 			}
-			if len(additions) == 0 { // only apply on default listener
-				if inbound.IsRemoteAddrDisAllowed(c.RemoteAddr()) {
+			if len(additions) == 2 { // only apply on default listener
+				if !inbound.IsRemoteAddrDisAllowed(c.RemoteAddr()) {
 					_ = c.Close()
 					continue
 				}
diff --git a/listener/socks/tcp.go b/listener/socks/tcp.go
index 8016e958..a33f190e 100644
--- a/listener/socks/tcp.go
+++ b/listener/socks/tcp.go
@@ -59,8 +59,8 @@ func New(addr string, tunnel C.Tunnel, additions ...inbound.Addition) (*Listener
 				}
 				continue
 			}
-			if len(additions) == 0 { // only apply on default listener
-				if inbound.IsRemoteAddrDisAllowed(c.RemoteAddr()) {
+			if len(additions) == 2 { // only apply on default listener
+				if !inbound.IsRemoteAddrDisAllowed(c.RemoteAddr()) {
 					_ = c.Close()
 					continue
 				}