Update default policy to ALLOW