Public IP

A public IP is an IP address that is globally unique and routable on the public Internet, so packets sent to it from any network can reach the device or service that holds it. In Internet addressing it is the opposite of a private IP: it comes from address space allocated through the IANA and regional Internet registry hierarchy, and it is announced to the global routing system, normally through BGP.

Public addresses exist in both protocol versions. In IPv4 they are scarce, because the 32-bit space offers about 4.3 billion addresses and large blocks are reserved; in IPv6 they are abundant, and almost every device can receive one. Whether a device actually has a public IP depends on its network: a home computer usually shares a single public address through NAT, while a web server is normally reachable on its own.

How a public IP is allocated and routed

Public addresses follow a strict delegation chain. IANA allocates large blocks to the five regional Internet registries (ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC), which assign them to Internet service providers, hosting companies and large organizations. A provider then assigns individual addresses or small prefixes to customers, and records ownership in a public WHOIS or RDAP database.

An address becomes reachable only when the prefix that contains it is announced in BGP by an autonomous system. Most networks filter IPv4 announcements smaller than a /24 prefix (256 addresses) and IPv6 announcements smaller than a /48, so a single address is never routed on its own but always as part of a larger block. Resource certification with RPKI lets networks verify that the announcing system is authorized to originate the prefix.

Public and private address ranges

An IPv4 address is public when it is not inside any reserved range. The best known exclusions are the RFC 1918 private ranges, but several other blocks are also not routable on the Internet. The table lists the ranges that most often cause confusion when deciding whether an address is public.

In IPv6, public addresses are global unicast addresses from 2000::/3. The ranges fc00::/7 (unique local), fe80::/10 (link-local) and ::1 (loopback) are not public. Unlike IPv4, a single IPv6 host often holds several addresses at once, including a public one and temporary privacy addresses that change regularly.

Static, dynamic and shared public addresses

A public IP can be static, staying the same for months or years, or dynamic, assigned through DHCP or PPP and changing on reconnection or at intervals. Residential lines typically receive dynamic addresses, while business lines and servers use static ones because DNS records, firewall allow-lists and email reputation depend on a stable address.

Because of IPv4 exhaustion, many mobile networks and some fixed providers use carrier-grade NAT (CGNAT), which places hundreds of customers behind one public address. The customer router then receives an address from 100.64.0.0/10, and inbound connections become impossible without provider support. The table compares the common situations.

Using and protecting a public IP

Any device with a public IP is exposed to constant automated scanning; a new address typically receives probe traffic within minutes. The decisive rule is that a public address should sit behind a default-deny firewall that opens only the ports a service actually needs, such as 443 for HTTPS. NAT on home routers hides internal hosts as a side effect, but it is not a security control, and IPv6 hosts rely entirely on firewall policy.

Practical decisions about public addresses are summarized in the decision table below, which pairs common needs with the usual approach.

Common misconceptions about public IPs

• A public IP does not identify a person. It identifies a network endpoint at a moment in time; behind it may sit a household, an office or thousands of CGNAT users.
• IP geolocation is approximate. Databases infer location from registry data and measurements, and errors at city level are common.
• The address shown by a lookup service is the public address of the outermost NAT or proxy, not of the local device.
• Owning an address block is not permanent. IPv4 space can be transferred or sold under registry policies, and reputation history moves with the block.

In plain words

A public IP is like the street address of a building that anyone in the world can send mail to. Inside the building, rooms have their own numbers, which work only for people already inside; those are private addresses.

Most homes have one public address shared by every device in the house. The router acts like a reception desk, passing incoming replies to the right room. Servers that the whole world must find, such as websites, need their own public address so visitors can reach them directly.

A real-world example

A small architecture office wants staff to reach its file server from home. Its broadband line has a dynamic public IPv4 address, and remote connections break each time the provider changes it. The office asks for a static public IP for a modest monthly fee and points a DNS name to it.

The router forwards only the VPN port to an internal gateway, and all other ports stay closed. Staff connect to the DNS name, the VPN authenticates them, and they reach the file server on its private address. One employee working from a mobile hotspot behind CGNAT connects without trouble, because the connection is outbound from the laptop to the office’s public address. The office gains reliable remote access with a single exposed service.