Private vs Public IP Addresses

1. The Two Worlds of IPv4 Addressing

Every IPv4 address falls into one of two fundamental categories: private or public. Understanding the distinction is essential — it explains why your home network uses addresses like 192.168.1.x, why those addresses can never be reached directly from the internet, and why NAT exists at all.

The IPv4 address space contains approximately 4.3 billion addresses (2³²). That sounds enormous, but with billions of internet-connected devices worldwide it is nowhere near enough to give every device a unique globally routable address. The solution, formalised in RFC 1918 (1996), was to designate three ranges of addresses as private — reserved exclusively for use inside organisations, never routed on the public internet — and to use NAT to translate between private and public addresses at the network boundary.

Related pages: Private vs Public IP – Overview | NAT Overview | Static NAT | Dynamic NAT | PAT (Overload) | IP Interface Brief | IPv6 Overview

2. RFC 1918 — The Three Private Address Ranges

RFC 1918 ("Address Allocation for Private Internets") defines exactly three IPv4 address blocks as private. These are the only RFC 1918 private ranges — every other address in the IPv4 space is either public or reserved for a special purpose.

  The three RFC 1918 private blocks visualised within the IPv4 space:

  0.0.0.0                                               255.255.255.255
  ├─────────────────────────────────────────────────────────────────────┤
  │                     Full IPv4 Address Space                         │
  └─────────────────────────────────────────────────────────────────────┘
       │                       │                    │
       ▼                       ▼                    ▼
  ┌──────────┐          ┌────────────┐        ┌──────────────┐
  │10.0.0.0/8│          │172.16.0.0  │        │192.168.0.0   │
  │  ~16.7M  │          │   /12      │        │    /16       │
  │addresses │          │  ~1M addrs │        │  ~65K addrs  │
  └──────────┘          └────────────┘        └──────────────┘
  Class A private        Class B private        Class C private
  (1 huge block)         (16 class B blocks)    (256 class C blocks)

Why Multiple Private Ranges?

The three ranges offer flexibility for different network sizes. A small home or office needs only a handful of addresses — 192.168.x.x is ideal. A large enterprise or cloud provider managing hundreds of thousands of internal devices needs the vast space of 10.0.0.0/8, which can be sub-divided into thousands of subnets. The 172.16.0.0/12 range sits between the two in scale.

3. Why Private Addresses Cannot Be Routed on the Internet

Private addresses are not globally unique. Your home router and your neighbour's home router almost certainly both use 192.168.1.0/24 internally. A company's head office and its branch office may both use 10.10.x.x. This deliberate re-use is the whole point of private addressing — it multiplies the effective address space enormously.

However, this re-use creates an insurmountable problem for internet routing: if a packet with destination 192.168.1.10 arrived at an internet router, there would be no way to know which of the millions of networks using 192.168.1.0/24 the packet was intended for. The internet routing system relies on globally unique addresses to deliver packets to the right destination — an ambiguous private address makes that impossible.

  Why private addresses cannot be internet-routed:

  Organisation A                  The Internet               Organisation B
  ─────────────                   ───────────                ─────────────
  192.168.1.10 (PC-A)                                        192.168.1.10 (PC-B)
       │                                                           │
  [Router A]─── 203.0.113.1 ─── [Internet] ─── 198.51.100.1 ─── [Router B]

  If PC-A sends a packet to 192.168.1.10:
  → Router A has no route to 192.168.1.0/24 on the internet
  → Even if it did, is the destination PC-B or one of billions
    of other hosts also at 192.168.1.10 worldwide?
  → Ambiguity is unresolvable — routing is impossible

  RFC 1918 solution:
  ISPs configure their border routers to DROP any packet whose
  source or destination is an RFC 1918 address. These routes are
  never advertised into BGP / the global routing table.

  The fix: NAT translates private → public at the network boundary,
  giving packets a globally unique source address before they
  enter the internet.

4. Private Addresses and NAT — The Connection

Because private addresses are non-routable on the internet, any device with a private IP address that needs internet access must go through Network Address Translation (NAT). NAT runs on the border router or firewall and translates the private source address in outbound packets to a public IP address — one that the internet can route back to.

  How NAT bridges private and public addressing:

  Private network (RFC 1918)        Border Router (NAT)      Internet (public)
  ──────────────────────────        ───────────────────      ─────────────────
  PC:  192.168.1.10   ──────────►  Inside interface:         Outside interface:
  (Inside Local addr)               192.168.1.1               203.0.113.1
                                   (ip nat inside)            (ip nat outside)
                                          │
                                          │  NAT translation:
                                          │  Src 192.168.1.10 → 203.0.113.1
                                          │
                                          ▼
                                   Packet on internet:
                                   Src: 203.0.113.1   ──────────► Dst: 8.8.8.8
                                   (publicly routable)

  Return traffic:
  Src: 8.8.8.8 → Dst: 203.0.113.1
  NAT router looks up translation table → delivers to 192.168.1.10

The three NAT types each handle this private-to-public translation differently:

See full detail: NAT Overview | Static NAT Lab | Dynamic NAT & PAT Lab

5. IANA-Reserved Special Address Ranges

Beyond RFC 1918 private addresses, the Internet Assigned Numbers Authority (IANA) has reserved several other address blocks for specific technical purposes. None of these are routable on the public internet, and none should be assigned to normal hosts. Understanding them prevents configuration mistakes and is tested on the CCNA exam.

6. Special Addresses You Must Know — Loopback and APIPA

6.1 Loopback — 127.0.0.1

The entire 127.0.0.0/8 block is reserved for loopback. Any packet sent to an address in this range is processed entirely within the local host's network stack — it never leaves the device, not even to the physical NIC. The address 127.0.0.1 is the universally recognised loopback address, often called localhost.

  Loopback use cases:

  1. Testing the local TCP/IP stack:
     ping 127.0.0.1
     → If this responds, the host's IP stack is functioning correctly.
     → If this fails, there is a fundamental OS networking problem.

  2. Local service communication:
     A web server and database on the same host communicate via 127.0.0.1
     without traffic ever hitting the physical network.

  3. Cisco router loopback interfaces:
     Router(config)# interface loopback 0
     Router(config-if)# ip address 10.0.0.1 255.255.255.255
     → Always up as long as the router is running (no physical link to fail)
     → Used as stable router IDs for OSPF, BGP, and management access

6.2 APIPA — 169.254.0.0/16

APIPA (Automatic Private IP Addressing), also called link-local addressing (RFC 3927), is the mechanism by which a Windows or macOS host self-assigns an IP address when it fails to receive a response from a DHCP server. The host randomly selects an address in the 169.254.0.0/16 range and uses ARP to verify it is not already in use on the local segment.

  APIPA address characteristics:

  Range:   169.254.0.0 – 169.254.255.255  (/16)
  Mask:    255.255.0.0
  Gateway: None (no default gateway is configured with APIPA)
  DNS:     None

  What APIPA means in practice:
  ┌────────────────────────────────────────────────────────────┐
  │  Host receives 169.254.x.x                                 │
  │  → DHCP server was not reachable                           │
  │  → Host CAN communicate with other APIPA hosts on the      │
  │    same segment (same 169.254.0.0/16)                      │
  │  → Host CANNOT reach any other subnet                      │
  │  → Host CANNOT reach the internet                          │
  │  → No default gateway = no routing beyond local segment    │
  └────────────────────────────────────────────────────────────┘

  Diagnosis: an APIPA address on a workstation almost always means
  a DHCP problem — check the DHCP server, pool exhaustion,
  ip helper-address configuration, and physical connectivity.

See also: DHCP Overview | Troubleshooting DHCP Clients Lab

7. Public IP Addresses — Allocation and Assignment

Public IP addresses are globally unique, IANA-managed addresses that are routable across the internet. IANA allocates large blocks to five Regional Internet Registries (RIRs), which in turn allocate smaller blocks to ISPs and large organisations. End users and businesses typically receive public IPs by leasing them from their ISP.

How Public IPs Are Assigned to End Users

  IANA
    │  Allocates large blocks (e.g., /8 or larger)
    ▼
  Regional Internet Registry (e.g., RIPE NCC for Middle East)
    │  Allocates smaller blocks (e.g., /16 or /24) to ISPs
    ▼
  ISP (Internet Service Provider)
    │  Assigns individual IPs or small blocks to customers
    ▼
  Customer / Organisation
    │  One public IP (for home/SMB, shared via PAT)
    │  Or a block of IPs (for larger orgs with servers)
    ▼
  End devices use public IP(s) directly (servers, firewalls)
  or access internet via NAT/PAT from private addresses

Static vs Dynamic Public IP Assignment

8. When Public IPs Are Assigned Directly to Hosts

While most end-user devices use private addresses behind NAT, there are scenarios where a device receives a public IP address directly, without any NAT between it and the internet.

  Comparison — private behind NAT vs public IP directly:

  Home / SMB (typical):
  [PC 192.168.1.10] → [Home Router NAT 203.0.113.1] → Internet
   Private IP            Public IP on WAN port
   (RFC 1918)            (ISP-assigned, shared by all home devices via PAT)

  Hosted web server:
  [Server 203.0.113.50] ──────────────────────────────► Internet
   Public IP directly on NIC — no NAT involved
   Internet users reach it at 203.0.113.50 directly

  Large enterprise DMZ:
  [Web Server 192.168.100.10] → [Firewall Static NAT] → [203.0.113.50] → Internet
   Private IP on server         Firewall translates      Public IP seen by internet
   (easier to manage internally) inbound/outbound

See also: Static NAT | IPsec VPN | ACL/Firewall Overview

9. Carrier-Grade NAT (CGNAT) — Running Out of Public IPs

With IPv4 public addresses exhausted, many ISPs now practice Carrier-Grade NAT (CGNAT), also called Large-Scale NAT (LSN). Instead of giving each customer a unique public IP, the ISP shares a single public IP across multiple customers simultaneously — adding a second layer of NAT on top of the customer's own home NAT.

  Double NAT — CGNAT architecture:

  Your PC               Home Router              ISP CGNAT Router        Internet
  ──────                ───────────              ────────────────        ────────
  192.168.1.10  ──PAT──► 100.64.x.x  ──────PAT──► 203.0.113.1  ────────► 8.8.8.8
  (RFC 1918)             (RFC 6598)               (public IP)
                         Shared Address            Shared across
                         Space — assigned          many customers
                         by ISP to CPE

  Your PC's traffic appears to the internet as coming from 203.0.113.1,
  shared with possibly hundreds of other customers.

  Implications of CGNAT:
  → Port forwarding for home servers becomes extremely difficult or impossible
  → Some online games and P2P applications break or degrade
  → Logging and law enforcement tracing requires ISP cooperation
  → The CGNAT range 100.64.0.0/10 (RFC 6598) is NOT RFC 1918 — it is a
    separate reservation specifically for ISP internal use

10. Identifying Address Types — Quick Reference

Given any IPv4 address, you should be able to instantly classify it. Here is a rapid identification guide for the CCNA exam and real-world troubleshooting:

  Address identification flowchart:

  Given an IPv4 address — what type is it?

  Starts with 10.           → RFC 1918 private (Class A)
  Starts with 172.16–172.31 → RFC 1918 private (Class B)
  Starts with 192.168.      → RFC 1918 private (Class C)
  Starts with 127.          → Loopback (never leaves the host)
  Starts with 169.254.      → APIPA / Link-local (DHCP failed)
  Starts with 100.64–100.127→ CGNAT Shared Address Space (RFC 6598)
  Starts with 0.            → "This network" / unspecified (DHCP Discover src)
  Starts with 224–239.      → Multicast
  Starts with 240–255.      → Reserved (Class E, not used)
  192.0.2.x, 198.51.100.x,
  203.0.113.x               → Documentation / TEST-NET (never in production)
  255.255.255.255           → Limited broadcast
  Anything else             → Public (globally routable)

See also: IP Interface Brief | Wildcard Masks | IPv6 Overview

Test Your Knowledge — Private vs Public IP Quiz