[1-netwerk] start work on a slightly stricter override to restrictconnections