Private, public and special-purpose IP addresses
Private, shared, local and special-purpose address ranges have different routing roles, and a globally assigned address still needs a permitted service path to be reachable.
A private address can work perfectly inside a home and still be meaningless as an outside client’s destination. Its scope belongs to the private routing realm using it.
The other common mistake is to call every address outside the private ranges “public.” Several other ranges have special purposes.
The three private IPv4 blocks
RFC 1918 reserves:
| Prefix | Included address range |
|---|---|
| 10.0.0.0/8 | 10.0.0.0–10.255.255.255 |
| 172.16.0.0/12 | 172.16.0.0–172.31.255.255 |
| 192.168.0.0/16 | 192.168.0.0–192.168.255.255 |
These addresses can be reused by unrelated homes and organizations. A route for your home’s 192.168.50.20 must select your private realm, not somebody else’s equal address.
The boundary around 172 is important: 172.20.1.1 is inside RFC 1918 space, while 172.40.1.1 is outside that block. The first displayed number alone is insufficient.
Non-private does not imply an ordinary public destination
| Other range | Purpose |
|---|---|
| 100.64.0.0/10 | Shared address space, commonly associated with carrier-grade NAT |
| 127.0.0.0/8 | IPv4 loopback |
| 169.254.0.0/16 | IPv4 link-local communication |
| 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 | Documentation examples |
The current IANA special-purpose registry distinguishes properties such as forwarding and global reachability. It provides more precise context than one “not private” test.
The documentation blocks used in these Learn examples stand in for outside address labels in invented topologies. They are not actual public services to contact.
A global allocation still needs a complete path
A globally assigned destination can lack a route, be filtered, have no listener at the selected port or reject the application request.
NAT can translate a household’s private IPv4 endpoints to an outside allocation. The translation does not add a user account, TLS certificate or permission to view a library.
Similarly, an address range being private is not a security boundary by itself. Private networks can be interconnected or accessed through tunnels; the configured policies determine what traffic is allowed.
IPv6 has its own categories
IPv6 has loopback, link-local, unique local and globally routed categories. Locally assigned ULA prefixes use the fd portion of fc00::/7 and are intended for private routing rather than normal global-internet reachability.
The documentation prefix 2001:db8::/32 is another special-purpose range.
See Also
- NAT and address/port translation state
- Carrier-grade NAT and control of inbound mappings
- IPv6 addressing, scope and reachability
- Firewalls, traffic rules and connection state