The browser page is blank
Check Whether assets-proxy.anthropic.com and the *.claudeusercontent.com hosts are allowed, not only claude.ai.
Fix Allow those hosts and reload.
Claude IP Ranges: What Anthropic Publishes for Allowlists
The address blocks from Anthropic's documentation, which direction each is for, and the checks that tell you the rule works.
The published ranges
| Item | Ranges | Use it to |
|---|---|---|
| Inbound IPv4 | 160.79.104.0/23, 153.61.224.0/22 | Allow your users or servers to reach Claude |
| Inbound IPv6 | 2607:6bc0::/48 | The same, over IPv6 |
| Outbound IPv4 | 160.79.104.0/21, 153.61.208.0/20 | Allow requests that Anthropic sends to your servers, such as MCP tool calls |
| Phased out | Five /32 addresses starting 34.162. | Remove them from firewall rules |
Copied from Anthropic's IP addresses page in the Claude API Docs, read on 11 November 2026. The page is for the Claude API and Claude Console; re-read it before you change a firewall.
Inbound and outbound: which one goes where
Inbound means the addresses where Anthropic services receive connections. Put them in the egress allow list of the firewall or proxy that your people or servers use to reach Claude. Outbound means the source addresses Anthropic uses for its own requests. Put them in the allow rules in front of a server that Claude has to call, for example a remote MCP server or a GitHub Enterprise Server.
Anthropic's Claude Code documentation gives the same instruction for a GitHub Enterprise Server behind a firewall: allow Anthropic's outbound addresses so Anthropic infrastructure can reach it.
What the ranges cover, and what to allow by name
Anthropic's page says the addresses are for the Claude API and Claude Console. It does not say they cover claude.ai or the apps. In our own lookup on 11 November 2026, api.anthropic.com, claude.ai, platform.claude.com and claude.com all resolved to 160.79.104.10, inside the inbound range, but that is one resolver at one moment and not a promise.
For the apps, use the hostnames in the Claude Code documentation: api.anthropic.com, claude.ai, claude.com and platform.claude.com, plus assets-proxy.anthropic.com and the *.claudeusercontent.com origins for the Desktop app and claude.ai. The documentation says allowing claude.ai while blocking those hosts gives a blank page.
Copy-ready list of the published addresses
Inbound (where Anthropic receives connections)
160.79.104.0/23
153.61.224.0/22
2607:6bc0::/48
Outbound (source of Anthropic requests, e.g. MCP tool calls)
160.79.104.0/21
153.61.208.0/20
Phased out - remove from firewall rules
34.162.46.92/32
34.162.102.82/32
34.162.136.91/32
34.162.142.92/32
34.162.183.95/32Copy of the Anthropic page as read on 11 November 2026, for reference only. Re-read the page before using it in a rule.
How to add Claude to a firewall allowlist
Step 1
Open Anthropic's IP addresses page and compare it with the list above. Use the page, not a copy, as the source of truth.
Step 2
Add the three inbound ranges to the egress allow list used by the people or servers that need Claude. Add the hostnames from the Claude Code documentation for the apps.
Step 3
If Claude must call your server, add the two outbound ranges to the allow rules in front of it.
Step 4
Remove any of the five phased-out addresses you allowlisted earlier.
Step 5
From a machine behind the rule, run curl -sS -o /dev/null -w "%{http_code}\n" https://api.anthropic.com/ and open claude.ai in a browser.
Expected result Any HTTP status code, not a timeout or a connection error; the exact code does not matter for this test.
The other direction: your team's address on Claude's allowlist
Claude also has an allowlist that works the other way. Anthropic's Help Center says IP allowlisting is in public beta for Enterprise plans and Claude Platform organizations, and that Owners (Enterprise) and Admins (Claude Platform) can manage it without involving Anthropic. There the list holds the addresses your people connect from, so those addresses have to stay the same.
If your team has no fixed office address, a leased static ISP IP can be that address: a 30-day lease holds one address for the term and is dedicated to one customer. Anthropic's Claude Code documentation adds that a proxy egress address belongs on the list only when it is dedicated to your organization, because a range that is not dedicated also admits that proxy's other customers.
If a rule does not work
With organization IP allowlisting on, Claude in Chrome cannot connect to Claude Code
Check Whether bridge.claudeusercontent.com leaves through the same egress address as claude.ai. Anthropic checks that host against your allowlist by the arriving address.
Fix Send that host through the same proxy egress, or add its egress address to the allowlist if that address is dedicated to your organization.
A server that Claude calls is not reachable
Check Whether the two outbound ranges are allowed in front of that server, and whether the five phased-out addresses are the only ones you allowed.
Fix Replace the old addresses with the current outbound ranges.
Claude IP ranges: FAQ
What are the Claude IP ranges?
Inbound: 160.79.104.0/23, 153.61.224.0/22 and 2607:6bc0::/48. Outbound: 160.79.104.0/21 and 153.61.208.0/20. Source: Anthropic's IP addresses page, read on 11 November 2026.
Do Claude's IP addresses change?
Anthropic says its fixed addresses will not change without notice, and it lists five older addresses as phased out and to be removed from firewall rules.
Do these ranges cover claude.ai and the apps?
Anthropic's page is for the Claude API and Claude Console and does not say. Allow the apps by hostname from the Claude Code documentation.
How do I allowlist my team's IP in Claude?
IP allowlisting is in public beta for Enterprise plans and Claude Platform organizations; Enterprise Owners and Claude Platform Admins manage it themselves.
Can a leased static IP be my allowlisted address?
A static ISP lease keeps one address for its term, from US$0.50 for 1 day to US$7.99 for 30 days, and a 30-day lease is dedicated to one customer. Anthropic advises adding a proxy egress address to the allowlist only when it is dedicated to your organization.
Read next
Claude and IP risk
How IP databases label datacenter, VPN, residential and ISP addresses, native vs broadcast ranges, and why one account should keep one IP.
Claude account environment
Match time zone, browser language and payment details to your IP’s country: what sites can read, how to check it, and where Anthropic is explicit.
Claude Code proxy setup
How to run Claude Code behind an HTTP proxy: HTTPS_PROXY, NO_PROXY, settings.json for background agents, and the checks that show it works.
Reference links
5
- Claude API Docs: IP addresses
Official documentation · Confirmed on:
Read in full on 11 November 2026. The page says Anthropic services use fixed IP addresses for inbound and outbound connections, to configure firewall rules for the Claude API and Claude Console, and that these addresses will not change without notice. Inbound IPv4: 160.79.104.0/23 and 153.61.224.0/22; inbound IPv6: 2607:6bc0::/48. Outbound IPv4, the stable addresses for outbound requests such as MCP tool calls to external servers: 160.79.104.0/21 and 153.61.208.0/20. Phased out and no longer in use: 34.162.46.92/32, 34.162.102.82/32, 34.162.136.91/32, 34.162.142.92/32 and 34.162.183.95/32; anyone who allowlisted them should remove them.
- Claude Help Center: Restrict access to Claude with IP allowlisting
Official documentation · Confirmed on:
Read on 11 November 2026: IP allowlisting is in public beta for Enterprise plans and Claude Platform organizations; Owners on Enterprise plans and Admins on Claude Platform can set up and manage it without involving Anthropic; artifacts shared outside the organization are not limited by the allowlist.
- Claude Code documentation: Enterprise network configuration
Official documentation · Confirmed on:
Read on 11 November 2026: the URLs Claude Code needs (api.anthropic.com, claude.ai, claude.com, platform.claude.com, among others); with organization IP allowlisting on, bridge.claudeusercontent.com is checked against the allowlist by the address the connection arrives from, so it must leave through the same egress as claude.ai; a proxy egress address may be added to the allowlist only when it is dedicated to your organization, because a range that is not dedicated also admits other customers of that proxy; for GitHub Enterprise Server behind a firewall, allow Anthropic's outbound IP addresses.
- Local DNS lookup of Anthropic hostnames
Local example · Confirmed on:
Run on 11 November 2026 from one machine with its default resolver: api.anthropic.com, claude.ai, platform.claude.com and claude.com each returned 160.79.104.10 (IPv4) and 2607:6bc0::10 (IPv6), both inside the published inbound ranges.
One resolver at one moment. DNS answers depend on location and time.
- Proxy302 product facts and price list
Product observation · Confirmed on:
Product facts file of the site, checked 10 November 2026 against the console, the backend and the price table: per-IP lease prices in US$ (1 PTC = US$1) for 1 to 90 days, HTTP port 2222 and SOCKS5 port 3333, quantity limit, no free trial, optional auto-renew.
Ready to try it?
Create an account, top up once, then pick rotating residential, static ISP or datacenter IPs and have one running in your browser within minutes.