diff --git a/internal/route/stream/tcp_tcp.go b/internal/route/stream/tcp_tcp.go
index eab1fe17..a12a3b67 100644
--- a/internal/route/stream/tcp_tcp.go
+++ b/internal/route/stream/tcp_tcp.go
@@ -53,17 +53,17 @@ func (s *TCPTCPStream) ListenAndServe(ctx context.Context, preDial, onRead netty
 
 	// TODO: add to entrypoint
 
-	if acl := acl.FromCtx(ctx); acl != nil {
-		log.Debug().Str("listener", s.listener.Addr().String()).Msg("wrapping listener with ACL")
-		s.listener = acl.WrapTCP(s.listener)
-	}
-
 	if ep := entrypoint.FromCtx(ctx); ep != nil {
 		if proxyProto := ep.SupportProxyProtocol(); proxyProto {
 			s.listener = &proxyproto.Listener{Listener: s.listener}
 		}
 	}
 
+	if acl := acl.FromCtx(ctx); acl != nil {
+		log.Debug().Str("listener", s.listener.Addr().String()).Msg("wrapping listener with ACL")
+		s.listener = acl.WrapTCP(s.listener)
+	}
+
 	s.preDial = preDial
 	s.onRead = onRead
 	go s.listen(ctx)