I followed the instructions I saw on a dozen pages. Installed [IP Address and Domain Restrictions], edited unspecified clients to Deny, added a single internal IP allow, iisreset. Yet I'm able to reach EAC from outside.
Same instructions on a dozen pages but here is a couple for reference:
What the configuration did you configure for unspecified clients?
Did you restart IIS before accessing ECP externally?