Public vs Private IP Addresses
If you have ever typed 192.168.1.1 into a browser to reach your router, you have used a private IP address. If you have ever looked up “what is my IP” and got something like 81.2.x.x, that was a public one. The two live in the same notation but do completely different jobs, and mixing them up is one of the first things that trips people up when they start managing a network.
The short version
A private IP address is only meaningful inside your own network. Millions of separate networks reuse the exact same private ranges, and that is fine because they never talk to each other directly. A public IP address is globally unique and routable on the open internet. Your home or office usually has just one public address, shared by every device behind it.
The private ranges (RFC 1918)
There are three blocks reserved for private use by RFC 1918. Any address inside them is private and will never be routed on the public internet:
| Range | CIDR | Addresses | Typical use |
|---|---|---|---|
| 10.0.0.0 to 10.255.255.255 | 10.0.0.0/8 | 16,777,216 | Large enterprises, cloud VPCs |
| 172.16.0.0 to 172.31.255.255 | 172.16.0.0/12 | 1,048,576 | Mid-size networks, Docker defaults |
| 192.168.0.0 to 192.168.255.255 | 192.168.0.0/16 | 65,536 | Home and small office routers |
The 192.168 range is the one most people recognise, because almost every consumer router hands out a 192.168.1.0/24 or 192.168.0.0/24 by default.
There are a few other special ranges worth knowing, though they are not “private” in the RFC 1918 sense: 169.254.0.0/16 is link-local (the address your machine gives itself when DHCP fails), 100.64.0.0/10 is carrier-grade NAT space used by ISPs, and 127.0.0.0/8 is loopback (127.0.0.1 is always “this machine”).
How private addresses reach the internet: NAT
If private addresses are not routable, how does your laptop on 192.168.1.50 load a web page? The answer is NAT, Network Address Translation. Your router sits on the boundary with one foot in your private network and one foot on the public internet. When your laptop sends a request out, the router rewrites the source address from your private 192.168.1.50 to its single public address, remembers the swap, and rewrites the reply on the way back.
The practical effect is that dozens of devices share one public address. It also means that, by default, nothing on the internet can start a connection to a device inside your network, because there is no public address pointing at it. That is a side benefit for security, and the reason you have to set up port forwarding when you want to host something.
How to tell which one you are looking at
Quick test: if an address starts with 10., 172.16 through 172.31, or 192.168, it is private. Everything else is almost certainly public (with the special-use exceptions above). The subnet calculator labels every network as public, private, or special automatically, which is handy when you are staring at an unfamiliar range and cannot remember whether 172.20.x.x falls inside the private block (it does).
Why the distinction matters in practice
- You cannot reach a private address from outside. If a colleague says “just go to 10.0.5.4”, that only works if you are on the same network or VPN.
- Private ranges can overlap and cause grief. If your office uses
192.168.1.0/24and your home uses the same, connecting the two over a VPN gets messy fast because the addresses collide. This is exactly why larger networks pick something less common out of the 10.0.0.0/8 space. - Public addresses cost money and are scarce. IPv4 ran out years ago, which is why NAT is everywhere and why IPv6 exists. With IPv6, every device can have its own globally unique address again, and the public/private split works differently.
Try it
Open the subnet calculator, type in any address, and watch the type label. Try 10.0.0.0, then 8.8.8.8, then 169.254.1.1, and see how each is classified. For a tour of the special ranges, the subnetting guide and CIDR reference go deeper.