Public and Private IP Addresses

What are public and private IP addresses?

Every IP address is either public or private (or one of a few special addresses covered later in this lesson).

💡 In simple terms: a private address is like an office extension number ("call 214"). It works fine inside the building, and every company can have its own extension 214. A public address is like the company's main phone number: unique in the world, and the only number outsiders can dial.

Why private addresses exist

IPv4 addresses are 32 bits long, so there are only about 4.3 billion of them. Today there are far more phones, laptops, TVs, cameras and servers than that. The regional registries ran out of free public IPv4 addresses during the 2010s.

In 1996, a standard called RFC 1918 set aside three blocks of addresses for private use. The idea is simple:

Private addresses bring two extra benefits. You can design your internal network freely, without asking a provider for addresses. And if you change provider, only the public address on the router changes; nothing inside the network needs new addresses.

The three private ranges (RFC 1918)

Learn these three blocks by heart. Every network engineer knows them.

The /8, /12 and /16 show how many bits at the start of the address are fixed (the subnet mask length). A network can use any part of a block. A home router might use only 192.168.1.0/24, while a company might use 10.0.0.0/8 split into hundreds of smaller subnets.

Is this address private? A quick check

1. Does it start with 10.? → Private.
2. Does it start with 192.168.? → Private.
3. Does it start with 172.? Look at the second octet. 16 to 31 → private. Anything else → not private.
4. Does it start with 127., 169.254. or 100.64–100.127? → Special (see below), not public.
5. None of the above? → Most likely a public address.

Where each type of address is used

Private addresses are used inside the network: on PCs, phones, printers and the inside interface of the router. The public address is on the outside (WAN) interface of the router that connects to the internet provider. The router is the border between the two, and in a home or small office it is usually also every device's default gateway.

How private devices reach the internet

If internet routers don't route private addresses, how does your laptop at 192.168.1.10 load a website? The home router changes the address on the way out. This is NAT (Network Address Translation), or more exactly PAT (Port Address Translation), which also changes port numbers so that many devices can share one public address. Follow a request step by step:

What changes in the packet

Only the laptop's private address and port are rewritten. The server's public address never changes. Later lessons explain how the translation table works.

Learn more: Why NAT Exists · How NAT and PAT Work

A side effect: devices on the internet cannot start a connection to your laptop, because there is no NAT table entry for their traffic to match. That is why hosting a game server at home needs port forwarding, a fixed rule on the router that sends one public port to one private address.

Carrier-grade NAT (CGNAT): 100.64.0.0/10

Many internet providers no longer have enough public addresses to give one to every customer. So they add a second layer of NAT inside their own network. This is carrier-grade NAT (CGNAT). Your router gets an address from the special block 100.64.0.0/10 (100.64.0.0 to 100.127.255.255), and the provider translates that to a public address shared by many customers.

100.64.0.0/10 is not one of the RFC 1918 ranges, and it is not public either. It exists so that providers don't clash with the private ranges customers already use at home. If your router's WAN address starts with 100.64 to 100.127, you are behind CGNAT, and port forwarding from the internet will usually not work.

Other special addresses you will see

How to find your private and public IP addresses

Your private address

Ask your own computer. On Windows:

C:\> ipconfig
Wireless LAN adapter Wi-Fi:

   Connection-specific DNS Suffix  . : home.arpa
   IPv4 Address. . . . . . . . . . . : 192.168.1.10
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.1.1

On Linux (macOS: ipconfig getifaddr en0):

$ ip -brief address
lo               UNKNOWN        127.0.0.1/8 ::1/128
wlan0            UP             192.168.1.10/24 fe80::ff:fe00:10/64

Your public address

Your computer usually doesn't know its public address, because the router translates its traffic. You have to ask a service on the internet which source address it sees: open What Is My IP. You can also look at the WAN or Internet status page of your home router. If the router's WAN address is different from the one the website shows, you are probably behind CGNAT.

When it goes wrong

Common mistakes

• Thinking all 172.x.x.x addresses are private. Only 172.16.0.0 to 172.31.255.255 is private. Addresses such as 172.32.1.5 are public.
• Thinking a private address means “safe”. The firewall decides what traffic is allowed, not the address type. Malware and phishing still reach private devices.
• Expecting the internet to reach a server that only has a private address. Without static NAT or port forwarding on the router, there is no way in from outside.
• Assuming any non-private address is public. Loopback, link-local, CGNAT and documentation ranges are special and are not routed as normal public addresses.
• Using 192.168.0.0/24 or 192.168.1.0/24 for a company network. Many home networks use the same ranges, so staff connecting over VPN will see address clashes.

Check yourself

Next, learn how a device knows which part of an address is the network.

Learn more: Subnet Mask Basics