We are currently not forwarding the IP address of the incoming request. Because of this, we are unable to support Home Assistant instances that have configured 127.0.0.1 or ::1 as trusted networks or proxies. It also means that if you use IP bans, the remote connection will be banned as a whole instead of just the address from which the incorrect passwords were entered. We are currently exploring a solution for this issue.
It's not currently possible to use IP bans with external traffic from Nabu Casa. From https://www.nabucasa.com/config/remote/:
See also NabuCasa/hass-nabucasa#143.