Private IP Address Ranges
Private IPv4 addresses are used inside homes, offices, data centers, and other local networks. They may be routed within private networks, but they are not intended to be globally routed and should not legitimately appear on the public Internet. The same address can be reused independently by millions of networks.
RFC 1918 defines three IPv4 ranges for use within private networks: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. An address is private only when it falls inside one of those exact boundaries. The number after the slash is a CIDR prefix length; see CIDR notation explained.
Which three IPv4 ranges are private?
| CIDR block | First address | Last address | Total addresses |
|---|---|---|---|
| 10.0.0.0/8 | 10.0.0.0 | 10.255.255.255 | 16,777,216 |
| 172.16.0.0/12 | 172.16.0.0 | 172.31.255.255 | 1,048,576 |
| 192.168.0.0/16 | 192.168.0.0 | 192.168.255.255 | 65,536 |
Note that for the 172.16.0.0/12 block only addresses from 172.16.0.0 through 172.31.255.255 are private. For example, 172.20.5.4 is private, but 172.15.5.4 and 172.32.5.4 are not.
How can I recognize a private IP address?
| Example | Private? | Reason |
|---|---|---|
| 10.24.8.3 | Yes | Inside 10.0.0.0/8. |
| 172.31.255.255 | Yes | The final address in 172.16.0.0/12. |
| 172.32.0.1 | No | Outside the range ending at 172.31.255.255. |
| 192.168.50.10 | Yes | Inside 192.168.0.0/16. |
| 192.169.1.1 | No | The second number is not 168. |
What is the private range for IPv6?
IPv6 does not use the three RFC 1918 ranges. Its private-like space is called Unique Local Addressing (ULA) and uses fc00::/7. RFC 4193 leaves the fc00::/8 half reserved because no assignment method is defined. Locally generated ULA prefixes use fd00::/8.
Generate the 40-bit Global ID within fd00::/8 with the pseudo-random method described by RFC 4193. A memorable fixed value increases the chance of a collision when separately managed networks later connect or join the same VPN. ULA addresses are intended for communication inside one site or a limited group of connected sites and are not expected to be routed across the public Internet.
Why do websites see a public address instead of my private address?
In a common RFC 1918 IPv4 setup, a router uses Network Address Translation (NAT) to replace a device's private source address and port with a public address and port. A port is a number that helps direct traffic to the right application at an IP address. Websites see that public gateway address. Ordinary IPv6 routing does not normally translate a ULA into a global IPv6 address in the same way. Read how Network Address Translation works for the translation flow.
How do private ranges differ from CGNAT and loopback space?
Several non-public ranges have different purposes. They should not all be called private addresses:
| Block | Purpose | Difference |
|---|---|---|
| 100.64.0.0/10 | Shared address space for CGNAT. | Reserved for provider-side sharing, not RFC 1918 private use. |
| 127.0.0.0/8 | Loopback. | Refers to the local host, not another device on a private network. |
| 169.254.0.0/16 | IPv4 link-local. | Works only on the local link and is not an RFC 1918 range. |
See Special-purpose IP blocks for the complete IPv4 and IPv6 registry tables.
What does a private IP address in a log mean?
A private source address can be valid in logs collected inside your own network. Its meaning depends on the local address plan, DHCP leases, device inventory, network segment, and event time. A public IP lookup cannot identify the local device or user.
A private address in a public-facing application's client field often means the application logged its reverse proxy or an untrusted forwarding-header value. Confirm the immediate connection address and proxy configuration before using the field. See How to Find the Real Client IP Behind a Proxy.
Private addressing also does not provide authentication, encryption, or proof that traffic is safe. Access controls must still identify the network path and system that supplied the address.