The IP used by frontend can be different than the real endpoint, and unknown for the frontend itself, so make it catch-all to allow access.