Network requirements changedclaude-tag/admins/network-requirements
Nearest release: v2.1.287, published 5 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 1 Oct 2026 22:12 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+7added
Lines−7removed
From line
18
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits9to this page, all time
The whole hunk
from line 18, old and new numbered
/
from line 18
1818
1919The authoritative list is [Anthropic's published IP addresses](https://platform.claude.com/docs/en/api/ip-addresses); check it when you create the rule.
2020
21The range is shared across Anthropic services, and dedicated per-organization egress addresses aren't available, so the allowlist entry admits Anthropic's infrastructure as a whole. Your credential's [allowed websites](/docs/claude-tag/admins/add-connections#set-allowed-websites) are what scope which of *your* systems Claude can call.
21The range is shared across Anthropic services, and dedicated per-organization egress addresses aren't available, so the allowlist entry admits Anthropic's infrastructure as a whole. Your credential's [allowed websites](/docs/claude-tag/admins/add-connections.md#set-allowed-websites) are what scope which of *your* systems Claude can call.
2222
2323> [!NOTE]
2424>
25> If your Google Cloud project uses VPC Service Controls, an IP-based access level doesn't admit Claude's queries through the [BigQuery connection](/docs/claude-tag/admins/connections/bigquery). See [Allow the connection through a VPC Service Controls perimeter](/docs/claude-tag/admins/connections/bigquery#allow-the-connection-through-a-vpc-service-controls-perimeter) on the BigQuery page.
25> If your Google Cloud project uses VPC Service Controls, an IP-based access level doesn't admit Claude's queries through the [BigQuery connection](/docs/claude-tag/admins/connections/bigquery.md). See [Allow the connection through a VPC Service Controls perimeter](/docs/claude-tag/admins/connections/bigquery.md#allow-the-connection-through-a-vpc-service-controls-perimeter) on the BigQuery page.
2626
2727## Internet reachability
2828
from line 30
3030>
3131> A connected service must accept traffic from the internet (restricted by IP allowlist if you like). A service reachable only inside your private network can't be connected; private networking such as PrivateLink or VPC peering is not supported.
3232
33In an Anthropic-hosted environment, every request from a channel's sandbox to your service passes through [Agent Proxy](/docs/claude-tag/concepts/agent-identity#agent-proxy), which carries HTTP and HTTPS only. A service reachable only over another protocol, such as SSH or a database's native wire protocol, can't be connected; put an HTTP API in front of it instead.
33In an Anthropic-hosted environment, every request from a channel's sandbox to your service passes through [Agent Proxy](/docs/claude-tag/concepts/agent-identity.md#agent-proxy), which carries HTTP and HTTPS only. A service reachable only over another protocol, such as SSH or a database's native wire protocol, can't be connected; put an HTTP API in front of it instead.
3434
3535## IP allowlist vs. allowed websites
3636
37The IP allowlist on your service and the [allowed websites](/docs/claude-tag/admins/add-connections#set-allowed-websites) on a connection are opposite sides of the same boundary:
37The IP allowlist on your service and the [allowed websites](/docs/claude-tag/admins/add-connections.md#set-allowed-websites) on a connection are opposite sides of the same boundary:
3838
3939| | IP allowlist | Allowed websites |
4040| :- | :- | :- |
from line 47
4747
4848## Related resources
4949
50* [Add connections](/docs/claude-tag/admins/add-connections#set-allowed-websites): the allowed-websites setting (the other direction: what Claude is allowed to reach)
51* [Allow a host without a credential](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential): how hosts become reachable from a channel, including [allow-all egress](/docs/claude-tag/admins/add-connections#allow-all-hosts)
52* [How agent identity works](/docs/claude-tag/concepts/agent-identity): how credentials are injected at the network boundary
50* [Add connections](/docs/claude-tag/admins/add-connections.md#set-allowed-websites): the allowed-websites setting (the other direction: what Claude is allowed to reach)
51* [Allow a host without a credential](/docs/claude-tag/admins/add-connections.md#allow-a-host-without-a-credential): how hosts become reachable from a channel, including [allow-all egress](/docs/claude-tag/admins/add-connections.md#allow-all-hosts)
52* [How agent identity works](/docs/claude-tag/concepts/agent-identity.md): how credentials are injected at the network boundary
5353* [Setup overview](/docs/claude-tag/admins/setup-overview): back to the console flow once the allowlist is in place
5454
No line in this hunk matches that.