The ACL will always override CBSubs, because the destination isn't reachable so CBSubs can't do anything. You'll need to leave the ACL as Public if you want CBSubs to control access to the URL for Public users. If still not working even with being Public then disable SEF and see if issue persists. If still persists with SEF off then please PM backend super administrator login credentials and will take a look (please include instructions with your PM to duplicate).