Should Private IP Addresses Bypass Your Proxy?
Decide whether a private destination is local to the client or reachable from the proxy before bypassing an entire private address range.
A private address is not a location label saying “on this laptop's local network.” It can belong to a network reachable only from the proxy.
Imagine an approved proxy inside an office network. Its client asks it to reach 10.20.0.15. The proxy has the required route; the client outside that network does not. Adding the whole private range to the client's bypass list removes the one path that made the service reachable.
Private address space is also reusable. The same numeric address can identify something on the client's home network and something entirely different on the proxy's network. Choosing direct versus proxied routing can therefore choose a different destination context, not merely a faster path to the same machine.
Define intranet from the caller's perspective
Before adding a range exception, identify where the application runs, which network should contain the destination, and which component is meant to open the final connection. A container, a remote browser, and a desktop utility can have different answers.
Use a narrowly scoped name or address rule matching that intended arrangement. A generic list of every private range is not a substitute for the network policy.
If a direct route is genuinely intended, ordinary reachability and access permission must exist there. If the proxy is intended, keep its destination restrictions and authorization in place. The private address alone answers neither question.