Quick Summary
- Public IPs are globally unique and routable on the internet; private IPs (RFC 1918) are for internal use and are not routable on the public internet
- The three private ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 -- which is why millions of homes can all use 192.168.1.x without conflict
- NAT translates between private and public addresses so many devices can share one public IP to reach the internet
The Apartment-and-Street-Address Analogy
Picture a large apartment building. Inside, every unit has a number -- Apartment 12, Apartment 34 -- and those numbers only mean something within the building. Two different buildings can both have an Apartment 12 without any confusion, because no one outside relies on those internal numbers to find you. That is exactly what a private IP address is: meaningful only inside your own network.
The building itself, though, has a single street address that the whole city can find -- say, 742 Evergreen Terrace. Mail from anywhere in the world is delivered there, and then the building's front desk routes it to the right apartment. That street address is the public IP: globally unique and reachable from anywhere on the internet.
Public IP addresses are handed out in an orderly way -- IANA allocates large blocks to the regional internet registries, which in turn allocate them to ISPs and organizations -- so no two devices on the public internet share one. Private IP addresses come from special reserved ranges that everyone is allowed to reuse, because they never appear on the public internet. The piece that connects the two worlds is NAT, the front desk that translates between your internal apartment numbers and the building's one public street address.
How Private and Public Fit Together
Here is a typical home network. Inside, devices use private 192.168.1.x addresses; the router holds one public IP facing the internet and uses NAT to translate between them:
Is this IP private or public?
Type any IPv4 address (or tap an example). The tool classifies it and explains why.
The key thing to remember: a private address is not "less real" than a public one -- it is just scoped to your network. The moment its traffic needs to reach the wider internet, NAT swaps the private source address for the router's public address, so the rest of the world only ever sees the public one.
The Pieces, One at a Time
Public IPs: Globally Unique and Routable
A public IP address is unique across the entire internet and can be reached from anywhere. These addresses are allocated top-down: IANA hands large blocks to the regional internet registries (like ARIN and RIPE), which assign them to ISPs and large organizations. Because every public address must be unique, they are a finite, managed resource -- one of the main reasons NAT and IPv6 exist. To discover your own public IP you ask an external service, since your device itself only knows its private address.
Private IPs: The RFC 1918 Ranges
RFC 1918 reserves three blocks for private use that are never routed on the public
internet: 10.0.0.0/8 (10.0.0.0–10.255.255.255), 172.16.0.0/12
(172.16.0.0–172.31.255.255), and 192.168.0.0/16
(192.168.0.0–192.168.255.255). Anyone can use these inside their own network, and they can be
reused in countless separate networks without conflict precisely because they stay internal. Your
home, your office, and a coffee shop down the street can all run 192.168.1.0/24 at once.
NAT: The Bridge Between the Two
Since private addresses cannot travel on the public internet, something must translate them. NAT (Network Address Translation), performed by your router, rewrites the private source address of outbound packets to the router's single public IP and remembers each connection. When replies come back, it rewrites the destination back to the right private address. This is how dozens of devices, all with private addresses, share one public IP to reach the internet -- and a big reason the IPv4 address shortage has not stopped the internet from growing.
Other Special Ranges to Recognize
A few ranges are neither ordinary private nor public addresses. 127.0.0.0/8 is
loopback -- 127.0.0.1 means "this device itself."
169.254.0.0/16 is link-local / APIPA, self-assigned when DHCP fails.
And 100.64.0.0/10 is CGNAT (RFC 6598), a shared space carriers use
between your router and their network when they run out of public IPv4 addresses. Recognizing these at
a glance saves a lot of troubleshooting time.
Private vs Public in the Real World
Here is where the distinction actually shows up day to day:
Your Home WiFi
Your router hands out private addresses like 192.168.1.20 to every device via DHCP, keeps
192.168.1.1 for itself, and holds one public IP from your ISP. All your devices share that
single public address through NAT, which is why a quick "what is my IP?" search shows the same answer on
every device.
A Corporate Network
Large companies often build on 10.0.0.0/8 because it offers millions of private addresses
to carve into department and site subnets. Internally everything uses private IPs; only the
internet-facing edge -- servers and NAT gateways -- holds public addresses, keeping the internal layout
invisible to the outside world.
An ISP Running CGNAT
When an ISP has more customers than public IPv4 addresses, it places homes behind
carrier-grade NAT using the 100.64.0.0/10 range. Your router may show a
100.64.x.x address on its internet side -- a sign you are sharing a public IP with other
customers, which can complicate hosting servers from home.
Common Mistakes and Misconceptions
These are the trip-ups that cause the most confusion:
Assuming All 172.x Is Private
Only 172.16.0.0 through 172.31.255.255 is private -- the /12
block. Addresses like 172.32.5.1 or 172.15.0.1 are public.
This off-by-a-bit boundary catches people constantly, so double-check the second octet (16–31).
Mistaking 169.254.x.x for a Working IP
A 169.254.x.x address almost always means DHCP failed and the device
self-assigned an APIPA address. It is not a healthy connection -- the device can only reach others on
the same link, not the internet. Treat it as a symptom, not a configuration you should keep.
Thinking Private Means Secure
A private IP keeps you off the public internet's address map, but it is not a security control by itself. Anyone already inside your network can reach a private address directly. Real protection comes from firewalls and access rules, not merely from using RFC 1918 space.
Why So Many Networks Reuse 192.168.1.x
It looks like a coincidence that nearly every home router lives at 192.168.1.1, but it follows
directly from the rules above. 192.168.0.0/16 is reserved private space, so it never appears on
the public internet, and each home network is isolated behind its own NAT. That isolation means there is
no conflict when millions of networks pick the same addresses. Router vendors simply
standardized on convenient defaults like 192.168.0.1 and 192.168.1.1, and the
habit stuck.
Finding Your Private and Public IP
These are two different lookups. Your private IP is what your own device reports --
ipconfig on Windows or ifconfig/ip addr on macOS and Linux -- and it
will be one of the RFC 1918 addresses. Your public IP, on the other hand, is the router's
internet-facing address, which your device does not directly know; you discover it by asking an external
"what is my IP?" service, which simply reports the source address it sees your traffic arriving from.
The bottom line: private and public IPs are two layers of the same addressing system. Private addresses (RFC 1918) keep order inside your own network and can be freely reused; public addresses keep order across the whole internet and must be unique. NAT stitches the two together so a houseful of private devices can share a single public identity on the global stage.
Frequently asked questions about private and public IPs
What is the difference between a private and public IP address?
A public IP address is globally unique and routable on the internet, allocated through IANA and the regional registries. A private IP address comes from a reserved range (RFC 1918) meant for internal networks and is not routable on the public internet, so it can be reused in millions of separate networks. NAT translates between a private address inside your network and a public address on the internet.
What are the private IP address ranges?
RFC 1918 defines three private IPv4 ranges: 10.0.0.0/8 (10.0.0.0–10.255.255.255), 172.16.0.0/12 (172.16.0.0–172.31.255.255), and 192.168.0.0/16 (192.168.0.0–192.168.255.255). Addresses in these ranges are reserved for internal use and are never routed on the public internet.
Why do so many devices use 192.168.1.1?
192.168.1.1 sits inside the 192.168.0.0/16 private range from RFC 1918, which is reserved for internal networks and is not routable on the public internet. Because these addresses never appear on the global internet, millions of home routers can all use 192.168.1.x at the same time without conflicting, since each network is isolated behind its own NAT.
What is 169.254.x.x (APIPA)?
169.254.0.0/16 is the link-local range, also called APIPA (Automatic Private IP Addressing). A device self-assigns an address from this range when it is set to use DHCP but cannot reach a DHCP server. Seeing a 169.254.x.x address is usually a sign that DHCP failed, so the device can only talk to other devices on the same link, not the wider network or internet.
How does a private IP reach the internet?
Through NAT (Network Address Translation), performed by your router. The router rewrites the private source address of outbound packets to its own public IP and tracks the connection, then rewrites the destination back to the correct private address on replies. This lets many devices with private addresses share a single public IP to reach the internet.
Try it in the lab
You just learned how private and public IPs differ and how NAT bridges them. Now build a network, assign private addresses, and trace a connection through a NAT gateway to see each one rewritten onto the public address and back.
Launch the networking lab →