Private IP Address Ranges Explained

IPv4 private and special-use ranges

The three RFC 1918 ranges

RFC 1918 reserves three blocks for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Anyone can use them without asking, which is also the catch: thousands of organizations use the same addresses, so they can never be routed across the public internet.

As a rule of thumb, 192.168.0.0/16 is what home routers and small offices use, 10.0.0.0/8 is what enterprises and cloud networks use because it offers 16.7 million addresses, and 172.16.0.0/12 sits in between. Be careful with the middle range: it ends at 172.31.255.255. Addresses such as 172.15.0.1 and 172.32.0.1 are public, a classic mistake when someone assumes everything starting with 172 is private.

A quick test for any address

• First octet is 10: private.
• First octet is 172 and the second octet is between 16 and 31: private.
• First two octets are 192.168: private.

100.64.0.0/10 and carrier-grade NAT

The 100.64.0.0/10 block is not part of RFC 1918. It is shared address space meant for internet providers that run carrier-grade NAT, where many customers sit behind one public address. If your router's WAN address falls between 100.64.0.0 and 100.127.255.255, your provider is doing NAT on top of your own, and inbound port forwarding from the internet will not work. You can confirm this by comparing the WAN address in your router with what What Is My IP reports.

Link-local and loopback

A device that cannot reach a DHCP server will often assign itself an address in 169.254.0.0/16 (Windows calls this APIPA). Seeing a 169.254.x.x address on a computer is a strong sign that DHCP failed, usually because of a cable, a VLAN, or a DHCP server problem. These addresses only work on the local link and are never routed.

The entire 127.0.0.0/8 block loops back to the local machine, not only 127.0.0.1. Services listening on 127.0.0.1 are reachable only from the host itself, which makes loopback a useful way to keep a database or admin interface off the network.

Planning around overlaps

Overlapping ranges are the most common private addressing problem. Two networks can only be joined by a VPN, a peering connection, or a merger if their ranges do not overlap, and renumbering a live network is painful.

• Home and office collide. Most home routers default to 192.168.0.0/24 or 192.168.1.0/24. A remote worker's VPN to an office that also uses 192.168.1.0/24 will route traffic to the wrong place.
• Container defaults. Docker's default bridge network uses 172.17.0.0/16, which can overlap with corporate networks that use the 172.16.0.0/12 range.
• Cloud defaults. The default VPC in an AWS region uses 172.31.0.0/16. If you connect it to an on-premises network that uses the same space, routing breaks.

For anything that might ever connect to another network, pick from 10.0.0.0/8 with a less obvious second octet, allocate a /16 per site or region, carve /24s from it for VLANs, and record the plan in a spreadsheet or an IPAM tool. Avoid 192.168.0.0/24, 192.168.1.0/24, 10.0.0.0/24, and 10.0.1.0/24, because everyone else picked those first. The /16 guide shows how to divide a block this way.

How private addresses reach the internet

Devices with private addresses reach the internet through network address translation (NAT). The router rewrites the source address of outgoing packets to its own public address and keeps a table so replies find their way back. This is why every device in a house shares one public IP, and why a private address on its own tells you nothing about where a device is on the internet.

IPv6 equivalents

IPv6 has no need for NAT-style address shortage, but it still reserves special ranges. Unique local addresses (fc00::/7, in practice fd00::/8) play the role of RFC 1918 and are not routed on the internet. Every IPv6 interface also has a link-local address in fe80::/10, which is used for neighbor discovery and routing protocol adjacencies.

Related tools and guides

Frequently asked questions