Public vs private IP addresses

In 1996 RFC 1918 set aside three blocks of IPv4 space that anyone may use inside their own network without asking a registry, on the condition that packets with those addresses never travel across the public internet. Internet routers drop them, so the same addresses can be reused in every home, office and data center on Earth. The three blocks differ only in size:

IPv6 has an equivalent, unique local addresses in fc00::/7 (in practice fd00::/8, RFC 4193), but because IPv6 has addresses to spare, most devices simply get a public IPv6 address alongside their private IPv4 one.

The largest block: a single network of 16.7 million addresses, or more usually a company's whole address plan carved into hundreds of subnets such as 10.20.30.0/24 per floor or office. Some internet providers use it on the private side of their equipment too, and a few home routers (notably some cable gateways) hand out 10.0.0.x by default.

Sixteen contiguous /16 networks, 172.16.x.x through 172.31.x.x. Often forgotten, which is exactly why it is useful: Docker picks its container networks from 172.17.0.0/16 upwards, and VPN products use it to avoid clashing with the 192.168 network of the home the user is connecting from. If an address starts with 172 but the second number is outside 16–31, it is public.

The home range: 256 networks of 256 addresses. Nearly every consumer router ships with 192.168.0.1 or 192.168.1.1 as its own address and hands out 192.168.0.x or 192.168.1.x to devices. That is why 192.168.1.1 opens the router admin page in millions of homes, and why a device list showing 192.168.1.20 tells you nothing about which house it is in. The subnet calculator flags any address that falls in a private range.

A public address is one from the globally routed part of the address space: registered to a network through a regional registry, announced to the internet's routing system, and reachable from anywhere. Your provider assigns one to your connection, usually dynamically; it is the address shown in the card below and the one every website, game and app sees. Everything else that is not reserved for a special purpose is public, from 1.0.0.0 to 223.255.255.255.

Ownership of public space is a matter of public record. The IP lookup shows which organization holds any address, which country it is registered in and roughly where it is used; what is an IP address covers the registry system. Two caveats for home users: a growing number of providers put customers behind carrier-grade NAT, so the "public" address a website sees is shared with other customers and the address your router reports is from the 100.64.0.0/10 range; and the public address of a mobile phone changes constantly and belongs to a gateway that may be in another city.

Private addresses would be useless if devices carrying them could not reach the internet. Network address translation (RFC 3022) solves this in the router. When your laptop at 192.168.1.20 sends a packet to a website, the router replaces the source address with its own public address and the source port with a port it picks, and stores the pair in a table: 203.0.113.42:51234 ↔ 192.168.1.20:52001. When the reply arrives for port 51234, the router looks up the table, puts 192.168.1.20 back and delivers it. Thousands of connections from many devices can share one public address because each gets its own outside port.

The scheme has two consequences you meet in daily life. Outgoing connections work for free, but an incoming connection has no table entry, so the router drops it; that is why a server, camera or game host at home needs port forwarding (a manual table entry) or UPnP, and why NAT doubles as a rough firewall. And since the website only sees the shared address, everything in the house looks like one user to it, which is how a whole family can be rate-limited together. Carrier-grade NAT repeats the trick at the provider for hundreds of customers at once, with the added problem that port forwarding becomes impossible; what is NAT and what is CGNAT go deeper, and the port checker shows what is actually reachable from outside.

Not every non-public address is an RFC 1918 private address. IANA keeps a registry of special-purpose blocks (RFC 6890 and later updates); these are the ones that turn up on home networks.

A practical rule: if an address is in 10/8, 172.16/12 or 192.168/16 it is private; if it is in one of the rows above it is special; otherwise it is public. The subnet calculator applies the full IANA registry to any address you type, and what is my local IP shows the private one your browser can see.