Appearance
Legacy custom rules matched specific domains/URLs in old VPN flow.
Rule drift and rule-order confusion were common in large sets.
Consolidate into current explicit host lists and app-level policy where possible.