{"version":"2.1.268","anchor":"gateway-login-now-flags-when-it-would-go-through-a-proxy-for","canonical_anchor":"managed-settings-can-restrict-a-cloud-gateway-sign-in-to-you","heading":"New gatewayInternalNetworks managed setting restricts Cloud gateway sign-in to declared network ranges","tier":"use","area":"Gateway","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268\/e\/gateway-login-now-flags-when-it-would-go-through-a-proxy-for","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268","markdown":"### New gatewayInternalNetworks managed setting restricts Cloud gateway sign-in to declared network ranges\n\nAdmins can lock Claude Code sign-in to a gateway that resolves only within their org's declared network CIDR blocks\n\n**What**\n\nA new admin-only managed-settings key, `gatewayInternalNetworks`, lets an organization declare the CIDR (network address range) blocks its Cloud gateway login host must resolve within.\n\n- Up to 4 non-overlapping blocks can be listed; Claude Code validates them and rejects public\/documentation\/reserved or overlapping ranges, and caps how many can be listed.\n\n- On `\/login`, Claude Code checks that both DNS resolution and the actual TLS connection to the gateway land inside a declared network, and refuses sign-in with a specific error if the machine's address or the gateway's answer falls outside it.\n\n- If the resolved gateway host falls inside a declared network but the connection would route through an HTTP proxy, login now refuses to proceed and tells the user to add the host to `NO_PROXY` instead.\n\n- The setting is merged using \"highest source wins\" rules, the same treatment given to `forceLoginOrgUUID`, `forceLoginMethod`, and `forceLoginGatewayUrl`, and it's threaded into the OAuth\/gateway login screen.\n\n**Why**\n\nThis lets an organization pin employee sign-in to a gateway that only exists on its own private or approved network, closing off sign-in attempts (or man-in-the-middle style redirects) that resolve or connect outside that network.\n\n- Area: Gateway\n- Names: `NO_PROXY`\n- Tier: Use it now\n- Useful: 4\/5\n- Signal: 3\/5"}