Just noticed that the temporary ban was overriding the csf.allow IPs when our webmail server was blocked from accessing one of our servers even though it was in the allow file.
Another "annoying" thing is that you can't remove the temporary bans through the csf interface (cpanel whm plugin)
It's not a bug. csf.allow is for configuring the iptable rules. If you don't want an IP address blocked by lfd, you have to list it in csf.ignore (and then restart lfd).
The request to have temporary bans removed is on the wishlist.