Istio Ingress IP whitelisting

I’ve tried RBAC approach with externalTrafficPolicy set to Local, but source.ip seems to contain IP chain, e.g. 172.29.3.75,164.38.33.33 so my whitelist does not match. Can Envoy filter this out and populate source.ip with real remote IP?