You'll notice
The gateway server now denies requests with unparseable or unknown client IPs when access control is on.
The standalone claude gateway server now validates the X-Forwarded-For header from trusted proxies. If a trusted proxy sends a value that can't be parsed as an IP and access_control (allow/deny CIDRs) is configured, the request is denied with a 403 instead of silently falling back to the proxy's own address for rate limiting and audit purposes. Requests where the client IP can't be determined at all are now also explicitly denied (client_ip_unknown) when access control is active.
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agree
Fixed Claude apps gateway client IP when a trusted proxy appends a port to X-Forwarded-For; with an access list set, an unreadable entry now…