IP Judge ipjudge.org
Muse Claude
US home broadband IP One-tap connect · no VPS needed Learn more Ad opens in a new tab

Guides ·

Claude Code in WSL, Docker or on a remote server: which IP does it actually use?

Claude Code only reads proxy variables (https_proxy and friends) from the environment it is running in. Inside WSL 2, a Docker container or on a remote server, the proxy you set up on Windows or macOS is not inherited: with no variable set, it connects directly from that environment's own network, and on a remote server the exit is simply the server's IP. Below is how to set the address in each case and how to confirm it (checked against the official docs on October 6, 2026).

At a glance: where Claude Code exits fromClaude Code reads only the proxy variables in the environment it runs in: your local terminal's variables (not the system proxy); the variables inside WSL 2, which does not inherit the proxy you set on Windows; the container's own variables, where 127.0.0.1 is the container itself; and on a remote server the exit is the server's own IP. Where does Claude Code exit from? Local terminal Local variables Proxied only if https_proxy is set WSL 2 WSL's variables Your Windows proxy is not carried over Docker container Container's variables 127.0.0.1 is the container itself Remote server Exit = server IP Over SSH it uses the server's network Same rule everywhere: no proxy variable, no proxy.
A proxy on your laptop says nothing about Claude Code inside WSL, a container or a server.

My laptop uses the proxy, so why does Claude Code in WSL or Docker go direct?

Because each of them has its own environment and its own network. Per the Claude Code network configuration docs, Claude Code uses the first one set of https_proxy, HTTPS_PROXY, http_proxy, HTTP_PROXY; it does not support SOCKS proxies; and it reads the variables once at startup. A shell inside WSL, a container or a server does not inherit your terminal's variables or your OS proxy settings, so you have to set them there.

The second trap is 127.0.0.1. In WSL 2 (default mode) and in a container it means WSL or the container itself, not your computer, so copying http://127.0.0.1:port from your host will not reach the proxy.

EnvironmentProxy addressExit if unset
Local terminal127.0.0.1:portYour network
WSL 2 (NAT, default)Windows host IPYour network
WSL 2 (mirrored)127.0.0.1:portYour network
Docker containerhost.docker.internal:port (Docker Desktop)The host's network
Remote serverA proxy the server can reachThe server's IP

How do I make Claude Code in WSL use the proxy on Windows?

It depends on the WSL networking mode. Per Microsoft's WSL networking docs, the default is NAT.

NAT (default): use the Windows host IP. Microsoft's command for it, combined into the proxy variables (replace the port with your proxy app's HTTP or mixed port):

WIN=$(ip route show | grep -i default | awk '{ print $3}')
export https_proxy=http://$WIN:7890 http_proxy=http://$WIN:7890

The same page notes that connections over this address are treated as coming from the LAN, so the proxy app on Windows must accept LAN connections (often labelled "Allow LAN"). If it only listens on 127.0.0.1, WSL cannot reach it.

Mirrored: on Windows 11 22H2 and later you can set networkingMode=mirrored under [wsl2] in .wslconfig. WSL can then reach Windows services at 127.0.0.1, so the address is the same as on Windows.

autoProxy: also Windows 11 22H2 and later. autoProxy=true under [wsl2] makes WSL use the Windows HTTP proxy settings. Either way, run env | grep -i proxy inside WSL to see what Claude Code will actually read.

Which proxy address to use inside WSL 2In the default NAT mode, 127.0.0.1 inside WSL is WSL itself, so use the Windows host IP from ip route, and the proxy app must accept LAN connections. On Windows 11 22H2 and later, setting networkingMode=mirrored under [wsl2] in .wslconfig lets WSL reach the Windows proxy at 127.0.0.1. Proxy address inside WSL 2 NAT (default) Windows host IP 127.0.0.1 means WSL itself Find the host IP with: ip route show | grep -i default Proxy app must accept LAN connections Mirrored Use 127.0.0.1 Windows 11 22H2 or later networkingMode=mirrored Under [wsl2] in .wslconfig Then check with env | grep -i proxy inside WSL.
WSL defaults to NAT, so copying 127.0.0.1:port from Windows will not connect.

How do I set it inside a Docker container?

Claude Code in a container only sees the container's environment. Three common ways:

  • Pass it at run time: docker run -e https_proxy=http://host.docker.internal:7890 …. Per the Docker Desktop docs, host.docker.internal resolves to the host's internal IP and is meant for reaching services on the host.
  • ~/.docker/config.json: set httpsProxy and httpProxy under proxies.default, and Docker sets HTTPS_PROXY / https_proxy and friends in new containers and builds (Docker docs). Existing containers are not affected.
  • Dev Containers: put the variables in containerEnv in devcontainer.json, the same mechanism the Claude Code dev container docs use.

Two easy misses: Docker's allProxy maps to ALL_PROXY, which Claude Code does not read, so fill in httpsProxy; and Docker Desktop accepts SOCKS5 proxies in its settings, but Claude Code does not support SOCKS, so give it an HTTP proxy. If you use the egress firewall (init-firewall.sh) from Anthropic's reference container, allow the proxy address too.

Using the host's proxy from a Docker containerClaude Code in the container reads the container's https_proxy, which points to host.docker.internal plus the port, reaching the HTTP proxy on the host and leaving through its exit. 127.0.0.1 loops back to the container, and socks5 or ALL_PROXY alone are ignored by Claude Code. Using the host's proxy Claude Code in the container Reads the container's https_proxy http://host.docker.internal:7890 HTTP proxy on the host → its exit These don't work 127.0.0.1: loops back to the container socks5:// or ALL_PROXY only: ignored Use your proxy app's HTTP / mixed port.
host.docker.internal is a Docker Desktop name that resolves to the host.

On a remote server, whose IP does Anthropic see?

The server's. Once you SSH in, Claude Code runs on the server with the server's network and the server's environment variables; whether your laptop has a proxy is irrelevant. So the exit to check is the server's: it needs to be in one of Anthropic's supported regions, and a cloud server's exit normally belongs to a hosting network, which our check labels "Datacenter".

To have Claude Code on the server use your local proxy instead, use SSH remote forwarding. Per the OpenSSH manual, -R forwards connections to a port on the server back to the local side:

ssh -R 7890:127.0.0.1:7890 your-server
export https_proxy=http://127.0.0.1:7890 http_proxy=http://127.0.0.1:7890

Run the first line on your machine and the second inside the server session. Requests then leave through your local proxy, and stop working when the SSH session closes.

Background sessions started with --bg or claude agents may not inherit your current shell. The official docs recommend putting proxy variables in the env block of ~/.claude/settings.json, which every background session reads.

How do I confirm where Claude Code actually exits?

Inside WSL, the container or the server, in the same shell you run Claude Code from:

curl -sL ipjudge.org/en/cc | bash

The script applies Claude Code's own rules (only the four proxy variables, no SOCKS, no ALL_PROXY) to work out the proxy it will use, asks api.anthropic.com which IP it sees, and compares that with the direct exit. Read-only: it installs, changes and uploads nothing.

You can also run /status inside Claude Code and look at the Proxy row; a value it cannot parse is marked invalid and ignored.

FAQ

curl works in WSL, but Claude Code still goes direct. Why? Usually only ALL_PROXY is set, or the proxy is written as socks5://. curl accepts both; Claude Code accepts neither. Use https_proxy=http://….

Why does 127.0.0.1:7890 fail inside a container? Inside the container, 127.0.0.1 is the container. On Docker Desktop use host.docker.internal:7890; if that still fails, check whether the host proxy only listens on 127.0.0.1.

I changed the variables, but the running session didn't notice. Claude Code reads them once at startup, so restart it. For background sessions, set them in ~/.claude/settings.json.

Does a remote server need a proxy at all? Not necessarily. If the server sits in a supported region, Claude Code can use its exit directly. Run the script above on the server to see what type of network the platforms will see.

I enabled mirrored mode. Do I still need the variables? Yes. Mirrored mode only lets 127.0.0.1 reach Windows; Claude Code still only follows the variables. With autoProxy=true, check env | grep -i proxy to see whether they were set for you.

Anthropic’s terms expect you to use its services from a supported region. Accounts that get around the restriction from elsewhere may be limited or disabled.

Related: Claude Code exit check · Claude check · Why your terminal goes direct · Claude Code 403 checklist · Residential vs datacenter IPs

Which kind of IP do you have?

Check which exit my terminal uses