The default configuration of Envoy will continue to trust internal addresses while in the future it will not trust them by default. Please explictily config internal address config as the migration step.
For more information, see envoyproxy/envoy@0ee424b.