Private vs public IP addresses

What makes an address private

IANA set aside three blocks of IPv4 address space, defined in RFC 1918, that routers on the public internet are configured to never forward: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Any device can use an address from these ranges on its own local network without asking anyone's permission, because the same address can be reused on millions of other private networks at the same time without conflict.

That reuse is exactly why the ranges exist. When RFC 1918 was published in 1996, it was already clear the internet did not have enough public IPv4 addresses for every device on every home and office network, so private ranges let organisations number their internal networks freely while only spending public addresses at the edge.

The three private ranges

10.0.0.0/8 is the largest, 16,777,216 addresses, and is the usual choice for large corporate and cloud networks that need room for many subnets. 172.16.0.0/12 holds 1,048,576 addresses and sits in the middle, less common but still seen in mid-sized deployments. 192.168.0.0/16 holds 65,536 addresses and is the default on almost every home router, usually carved down further to a single 192.168.1.0/24 or 192.168.0.0/24.

Two related ranges are private in spirit but reserved for a specific purpose rather than general use: 127.0.0.0/8, the loopback range where 127.0.0.1 always means this device, and 169.254.0.0/16, the link-local range a device assigns itself automatically when it cannot reach a DHCP server.

Every reserved IPv4 range, not just the private three

RFC 1918 gets all the attention, but it covers three blocks out of sixteen that are set aside for something. The rest matter because a packet from any of them behaves unlike a normal public address, and because two of them are routinely mistaken for private space.

The one that catches people out is 100.64.0.0/10. It looks private, it is not routed on the public internet, and it is not RFC 1918: it is carrier-grade NAT space, handed out by an ISP to sit between the customer and the real internet. Using it inside your own network is asking for a collision with your provider, and the symptom is a connection that works everywhere except from one carrier.

Only the three RFC 1918 rows are private address space. Loopback, link-local and CGNAT are separate things that happen to be unroutable, which is why a tool that lumps them together as private gives the wrong answer.

The IPv6 side, which does not work the same way

IPv6 has no NAT-by-default and no address shortage, so private addressing plays a much smaller role. The nearest equivalent to RFC 1918 is fc00::/7, unique local addresses, and even those are meant to be globally unique rather than reused everywhere the way 192.168.0.0/16 is.

There is also no broadcast address anywhere in IPv6, so nothing is reserved for it. The jobs broadcast did in IPv4 are done by multicast groups under ff00::/8, and every interface additionally carries a link-local address in fe80::/10 whether you configured one or not.

3fff::/20 is the newest entry here: a second documentation range added in 2024 by RFC 9637, because 2001:db8::/32 on its own was too small for examples that need several distinct networks.

How a private address reaches the public internet

A private address cannot be routed on the internet: no public router carries a route for 10.0.0.0/8, so a packet from a private address would have nowhere to go. Network Address Translation (NAT), running on your router or firewall, solves this by rewriting the source address of outgoing traffic to the router's own public IP address before it leaves the local network, then translating replies back to the right private address on the way in.

That is why a laptop can show a private address like 192.168.1.42 while an external site reports a completely different, public address: the private address is what the laptop knows about itself, and the public address is what the rest of the internet sees.

How to tell if an address is private

Check whether it falls inside 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16. The subnet calculator on this site flags an address as private automatically when you enter it, using exactly these three ranges plus loopback and link-local.

Everything outside those ranges, aside from a handful of other reserved blocks such as documentation ranges and multicast, is public: assigned to an organisation and, if actually routed, reachable from anywhere on the internet.

Sources

Everything technical on this page is checkable against the documents below. Where a document and common practice disagree, the guide says so rather than picking one quietly.

• RFC 1918: Address allocation for private internets
• RFC 6598: IANA-reserved IPv4 prefix for shared address space (carrier-grade NAT)
• RFC 3927: Dynamic configuration of IPv4 link-local addresses
• RFC 4193: Unique local IPv6 unicast addresses
• IANA IPv4 Special-Purpose Address Registry
• IANA IPv6 Special-Purpose Address Registry

Spotted something wrong? Tell us and it gets corrected. How the data is maintained is described on the about page.