A private IP is an IP address taken from ranges that are reserved for use inside private networks and are not routed on the public Internet. In Internet addressing, the IPv4 private ranges are defined in RFC 1918: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Any home, office or data center may reuse them, because packets carrying these addresses are never supposed to leave the local routing domain without translation.
Private addressing exists mainly because the IPv4 address space is too small for every device to hold a globally unique address. Combined with network address translation (NAT), private IPs let thousands of internal hosts share one or a few public addresses, while keeping internal numbering independent of the provider.
The reserved private address ranges
The three RFC 1918 blocks differ mainly in size, which shapes where each one is used. Large organizations favor the 10.0.0.0/8 block for its room to grow, while consumer routers almost universally default to a 192.168.x.0/24 subnet.
| Block | Address range | Number of addresses | Typical use |
|---|---|---|---|
| 10.0.0.0/8 | 10.0.0.0 to 10.255.255.255 | About 16.7 million | Enterprises, cloud virtual networks |
| 172.16.0.0/12 | 172.16.0.0 to 172.31.255.255 | About 1 million | Medium networks, container platforms |
| 192.168.0.0/16 | 192.168.0.0 to 192.168.255.255 | 65,536 | Home and small office routers |
Several other ranges look similar but serve different purposes. The 100.64.0.0/10 shared address space (RFC 6598) is meant for carrier-grade NAT between a provider and its customers, and 169.254.0.0/16 is used for link-local autoconfiguration when no DHCP server answers. Neither should be treated as an ordinary private LAN range.
How private IPs reach the Internet
A host with a private IP cannot exchange packets directly with the public Internet, because backbone routers drop or do not carry routes for RFC 1918 destinations. Communication works through NAT, usually in its port-based form, often called PAT or NAPT. The gateway rewrites the private source address and port into its own public IP and a chosen port, and keeps a translation table to reverse the mapping for replies.
This mechanism makes outbound connections easy but inbound connections difficult. An outside host cannot open a session to an internal device unless the gateway has a port forwarding rule, a relay is used, or a traversal technique such as STUN or hole punching establishes a mapping first. Providers that run carrier-grade NAT add a second translation layer, which makes inbound access harder still.
The following table contrasts private and public addresses on the points that matter in daily operations.
| Property | Private IP | Public IP |
|---|---|---|
| Uniqueness | Unique only within one network | Globally unique |
| Routed on the Internet | No | Yes |
| Assigned by | Local administrator or DHCP | Regional registry through a provider |
| Cost | Free to use | Limited and often paid |
| Reachable from outside | Only through NAT or forwarding | Directly, subject to firewalls |
Private addressing in IPv6
IPv6 does not need private addresses to save space, yet it still defines an equivalent: unique local addresses (ULA) in the fc00::/7 block, in practice fd00::/8, described in RFC 4193. Each site generates a random 40-bit global ID, which makes collisions unlikely when two networks later merge or connect through a VPN.
The important difference is that IPv6 hosts normally also have globally routable addresses. ULAs are used for stable internal services, while Internet traffic uses public addresses without NAT. The older site-local fec0::/10 prefix was deprecated and should not be used.
| Address type | Prefix | Scope |
|---|---|---|
| IPv4 private | 10/8, 172.16/12, 192.168/16 | Organization or site |
| IPv4 link-local | 169.254.0.0/16 | Single network segment |
| IPv6 unique local | fd00::/8 | Organization or site |
| IPv6 link-local | fe80::/10 | Single network segment |
Planning a private addressing scheme
A good plan uses CIDR subnets sized to real needs with room for growth, and it avoids the most common defaults where possible. The choice of range affects how easily the network can later connect to partners, VPN users and cloud environments.
| Situation | Recommended choice | Reason |
|---|---|---|
| Home network | Router default 192.168.x.0/24 | Simple and sufficient for dozens of devices |
| Company with remote VPN users | Uncommon 10.x or 172.16-31.x subnets | Avoids clashes with home router ranges |
| Cloud virtual networks | Non-overlapping /16 blocks per region | Allows future peering and transit |
| Mergers and partner links | Coordinated address registry | Overlaps require complex double NAT |
Document every allocation in an IP address management record, even in small environments. Overlapping private ranges are easy to create and expensive to fix later, because renumbering touches servers, firewall rules and DNS records.
Misconceptions and pitfalls
- A private IP is not a security control. NAT hides internal numbering, but a firewall policy is what actually blocks unwanted traffic.
- Private addresses are not anonymous. Outside services still see the public address of the gateway, which identifies the network.
- Leaked private addresses in public DNS or email headers reveal internal structure and should be avoided.
- Overlapping subnets break VPN routing when a home network and the office use the same range.
- Logs behind carrier-grade NAT need the source port and exact timestamp to identify a single subscriber.
The idea in brief
Think of a large office building with internal extension numbers. Extension 214 exists in thousands of buildings, and that causes no confusion, because it only works inside each building. To call the outside world, every call goes through the main switchboard with one public phone number.
A private IP is that internal extension. Your laptop, phone and printer each get one, often starting with 192.168. Your router plays the switchboard: it sends their traffic out under one shared public address and passes the replies back to the right device.
A practical scenario
A company with 300 employees numbers its office network with 192.168.1.0/24. When staff start working from home, the VPN fails for many of them, because their home routers use the same 192.168.1.0/24 range. Their laptops cannot tell whether an address belongs to the office or to the living room.
The network team renumbers the office to 10.42.0.0/16, split into /24 subnets per floor and function, and records the plan in an address management tool. VPN clients now receive routes only for the 10.42 block. After a planned weekend change, the VPN conflicts disappear, and the new scheme leaves enough space to connect a cloud network at 10.43.0.0/16 without overlap.