It seems there’s no way to get the equivalent of the `dst` internal ACL into an external ACL. %DST returns the hostname from DNS not the origin IP. Am I missing something? Perhaps there's a more creative way to pass the IP to an external ACL regardless of what the hostname is? Thanks!