Understanding the Difference Between Public and Private IPs

Your laptop might show 192.168.1.5, while a website that checks your IP shows a different address. Both can be correct. One identifies your laptop inside your network; the other is the address the website sees on the connection reaching it.

The same room number can exist in different buildings

Two hotels can both have a room 205. There is no confusion until someone tries to deliver a parcel using only the room number. Private IPv4 addresses work within a defined network in much the same way: your home and your neighbour’s home can both use 192.168.1.5.

An IP address identifies a network interface for communication in its routing context. It is not a permanent identity for a person or device. A phone can have different addresses on Wi-Fi and mobile data, and those addresses can change.

Which addresses are private?

RFC 1918 sets aside three IPv4 ranges for private networks:

• 10.0.0.0–10.255.255.255 (10.0.0.0/8)
• 172.16.0.0–172.31.255.255 (172.16.0.0/12)
• 192.168.0.0–192.168.255.255 (192.168.0.0/16)

You can use these inside a private network without requesting a globally unique allocation. They are not meant to be routed across the public Internet. Notice that only part of 172 is private: 172.32.0.1 is outside that range.

Reusing addresses also has a cost. If two offices both use the same subnet and then connect through a VPN, the network may not know which office a destination belongs to. Renumbering or carefully planned translation resolves the overlap; a VPN alone does not.

How a private device reaches a public service

In a typical home IPv4 connection, the router translates outgoing traffic from private addresses to a public address and records the ports needed to return each reply to the right device. This is usually NAPT, often called NAT. The website sees that translated source address. Our NAT guide follows a connection through this process.

Your provider may translate traffic again using carrier-grade NAT, so several customers share the public address seen by websites. The 100.64.0.0/10 range is shared address space for this purpose; it is separate from the three RFC 1918 ranges. A router’s WAN address therefore is not necessarily a public address.

Public does not mean open; private does not mean secure

A public address can participate in global routing. Actual access still depends on an advertised route, a running service and the network’s firewall rules. Public addresses are coordinated through providers and registries, but they are not all assigned directly by an ISP.

A private address is not encryption or a security policy. A compromised laptop, an exposed application or an overly permissive VPN can still reach internal systems. NAT can affect whether an unsolicited connection works, but firewall policy and authentication are the controls that decide who should get access.

Nor is every address outside the private ranges public. Some ranges have other special uses. For example, 203.0.113.25 belongs to a documentation range: it is useful in examples, not a real publicly reachable server address.

What this means for your network

For ordinary web browsing, private addressing with translation often works well. For hosting a service or joining two networks, ask where the address is valid, where translation happens and which connections are allowed. Those questions are more useful than simply asking whether an IP is public or private.

These are IPv4 examples; IPv6 has its own address scopes. The wider question of who controls access to number resources is explored in Lu Heng’s Note 29, which argues for operator autonomy and transferable IPv4 assets.