Overview
Not all IP addresses are the same kind. Some are public (routable on the global internet) and some are private (used only inside local networks). This distinction is central to how home and corporate networks connect to the internet and to how they are secured.
Learning objectives
- Distinguish public from private IP addresses.
- Recognize the private IPv4 ranges.
- Understand how private networks reach the internet.
Core concept
- Public IP addresses are globally unique and routable across the internet. They are assigned to organizations by regional registries and identify a network to the outside world.
- Private IP addresses are reserved ranges (defined in RFC 1918) used inside local networks. They are not routable on the public internet and can be reused by countless separate networks without conflict.
The reserved private IPv4 ranges are:
10.0.0.0–10.255.255.255(10.0.0.0/8)172.16.0.0–172.31.255.255(172.16.0.0/12)192.168.0.0–192.168.255.255(192.168.0.0/16)
How it works
Because private addresses cannot travel the public internet, devices using them reach the internet through NAT (Network Address Translation) on the router (covered in the routing/NAT module). NAT translates many private internal addresses to one (or a few) public addresses. This conserves scarce public IPv4 addresses and means internal hosts are not directly addressable from the internet — an incidental security benefit.
Practical example
Your home devices likely have addresses like 192.168.1.x (private). They all share your router's single public IP when reaching the internet, thanks to NAT. Your neighbor's network probably also uses 192.168.1.x — the same private range — with no conflict, because those addresses never leave either local network. Only the public IPs differ.
Cybersecurity relevance
The public/private split shapes exposure: private hosts are not directly reachable from the internet (reducing external attack surface), while public-facing addresses/services are prime targets that need hardening. Recognizing private ranges also helps in analysis — traffic to/from a private range is internal, which matters when reading logs and captures.
Common mistakes
- Believing private addressing alone equals security — NAT hides but does not fully protect; internal threats and misconfigurations remain.
- Not recognizing the RFC 1918 ranges when reading network configs or logs.
Key takeaways
- Public IPs are globally routable and unique; private IPs (RFC 1918: 10.x, 172.16–31.x, 192.168.x) are for internal use and not internet-routable.
- Private networks reach the internet via NAT, which conserves public addresses and hides internal hosts.
- Private addressing reduces external exposure but is not a complete security control by itself.
Check your understanding
- List the three private IPv4 ranges.
- Why can two different home networks both use
192.168.1.10without conflict?