The systemd documentation at https://github.com/systemd/systemd/blob/master/README states:
Required for IPAddressDeny= and IPAddressAllow= in resource control unit settings:
CONFIG_CGROUP_BPF Please, enable this in the kernel configuration. Best regards Heinrich Schuchardt
