diff --git a/internal/nodes/client_listener.go b/internal/nodes/client_listener.go
index 42b799e..2c2a1b9 100644
--- a/internal/nodes/client_listener.go
+++ b/internal/nodes/client_listener.go
@@ -42,10 +42,10 @@ func (this *ClientListener) Accept() (net.Conn, error) {
 	ip, _, err := net.SplitHostPort(conn.RemoteAddr().String())
 	if err == nil {
 		canGoNext, _ := iplibrary.AllowIP(ip, 0)
+		var beingDenied = !waf.SharedIPWhiteList.Contains(waf.IPTypeAll, firewallconfigs.FirewallScopeGlobal, 0, ip) &&
+			waf.SharedIPBlackList.Contains(waf.IPTypeAll, firewallconfigs.FirewallScopeGlobal, 0, ip)
 
-		if !canGoNext ||
-			(!waf.SharedIPWhiteList.Contains(waf.IPTypeAll, firewallconfigs.FirewallScopeGlobal, 0, ip) &&
-				waf.SharedIPBlackList.Contains(waf.IPTypeAll, firewallconfigs.FirewallScopeGlobal, 0, ip)) {
+		if !canGoNext || beingDenied {
 			tcpConn, ok := conn.(*net.TCPConn)
 			if ok {
 				_ = tcpConn.SetLinger(0)
@@ -54,9 +54,11 @@ func (this *ClientListener) Accept() (net.Conn, error) {
 			_ = conn.Close()
 
 			// 使用本地防火墙延长封禁
-			var fw = firewalls.Firewall()
-			if fw != nil && !fw.IsMock() {
-				_ = fw.DropSourceIP(ip, 60)
+			if beingDenied {
+				var fw = firewalls.Firewall()
+				if fw != nil && !fw.IsMock() {
+					_ = fw.DropSourceIP(ip, 60)
+				}
 			}
 
 			return this.Accept()