7.2 Public vs Private IP

Scope of Public and Private IP Addresses

In IP networking, every device that communicates using IP needs an address. Some of these addresses are meant to be reachable across the entire internet. Others are meant to stay only inside a local or organizational network. This separation creates two broad categories of IPv4 addresses: public and private.

This chapter focuses on what makes an address public or private, how private ranges are defined, and how these two types of addresses are used together in real networks, especially with the help of NAT. The more detailed structure of IPv4, subnetting, and planning will be covered in other chapters.

What Is a Public IP Address?

A public IP address is globally unique and is routable across the public internet. If a device has a public IP on its interface, then other devices on the internet can, in principle, send packets directly to it and receive packets from it.

Public IP addresses are allocated by organizations that manage the global IP space. Internet Service Providers, cloud providers, and large enterprises obtain blocks of public addresses from these registries and then assign them to customer routers, servers, and services.

A key idea is that the same public IP must not be reused somewhere else on the internet. This uniqueness is what allows routers all over the world to forward packets correctly. Public IP space is limited, so it is handled carefully and usually assigned to edge devices like routers and servers, not to every internal desktop or phone.

Public IPs are visible outside your network. When you visit a website such as a search engine, the server sees the public IP address that your connection uses, not your internal device address.

What Is a Private IP Address?

A private IP address is meant to be used only inside private networks such as home networks, office LANs, or internal corporate networks. These addresses are not globally unique. The same private IP range can be reused by millions of different networks all around the world, because these addresses are not supposed to be visible or reachable over the public internet.

Routers on the public internet are configured to treat private IP addresses as nonroutable. If a router on the internet receives a packet whose source or destination is a private address, it should drop it instead of trying to forward it.

Private addresses are mainly used to number devices inside a network in a flexible and inexpensive way. Instead of buying public addresses for thousands of internal devices, an organization can use private ranges internally and expose only a small number of public addresses at its edge.

The Reserved Private IPv4 Ranges

To make private networks possible, specific chunks of the IPv4 address space have been reserved for private use. These ranges are defined by standards so that every network engineer knows which addresses are safe to use internally.

The main private IPv4 ranges are:

These ranges were defined by RFC 1918, so they are often called “RFC 1918 addresses.”

Many home routers default to using part of 192.168.0.0/16. For example, it is common to see networks like 192.168.0.0/24 or 192.168.1.0/24 in small environments. Larger organizations may use 10.0.0.0/8 or 172.16.0.0/12 and then subdivide them with subnetting.

No device on the public internet should be configured with an address from these ranges on an interface that connects directly to the global network. They are intended only for internal use.

Key Differences Between Public and Private IPs

Although public and private IPs share the same general IPv4 structure, they differ in usage, reachability, and visibility.

In terms of reachability, public IP addresses are reachable across the internet. If firewall rules permit, you can connect from one public IP on one network to another public IP anywhere else. Private IP addresses are not forwarded across the internet. Traffic with private source or destination addresses should be blocked at the borders of the public network.

In terms of uniqueness, each public IP is globally unique. There is only one device or network that uses that address on the internet. Private addresses are not globally unique. The same address, for example 192.168.1.10, can exist in millions of different private networks at the same time without any problem, since these networks are isolated from each other.

Regarding assignment and cost, public addresses are managed and assigned by official bodies and by ISPs. They are considered a scarce resource and can be limited or expensive. Private addresses can be freely assigned by any organization inside its own network. There is no direct cost or central registration for using them.

From a security perspective, public addresses expose services directly to the internet. This does not automatically make them insecure, but it does mean that exposed servers and devices need proper security measures. Private addresses provide a basic form of isolation because they are not directly reachable from the internet. However, private addressing alone is not a complete security solution. Other controls such as firewalls and access control lists are still needed.

From the point of view of typical home users, the ISP assigns one or a few public IP addresses to the home router. Inside the home network, laptops, phones, and printers receive private IP addresses from the router, most often via DHCP. When those internal devices browse the internet, their traffic goes out through the router using the router’s public IP.

How Public and Private IPs Work Together with NAT

Private IP networks are able to communicate with the public internet by using Network Address Translation, which is covered in a later section of the course. At a high level, NAT allows many private IP addresses inside a network to share a smaller set of public IP addresses at the edge.

A typical sequence looks like this. A device inside a private network, such as 192.168.1.50, wants to contact a website on the internet with a public IP. The packet is sent to the local router, which has a public IP address on its internet facing interface. The router changes the source address in the packet from the private address 192.168.1.50 to its own public address, for example 203.0.113.5. It then forwards the packet onto the internet.

When the server replies, it sends the response back to 203.0.113.5. The router receives the reply, checks its NAT translation table to see which internal private IP initiated this flow, then rewrites the destination address from 203.0.113.5 back to 192.168.1.50 and finally forwards the packet into the private network.

In this way, the internet only ever sees the router’s public IP, while many private internal devices can still access external services. Outbound connectivity from private networks to the internet depends heavily on this translation between private and public address spaces.

Misuse and Common Pitfalls

Even though private ranges are clearly defined, they are sometimes misused. A common error is to assign private IP ranges to interfaces that connect directly to the internet or to external organizations without careful planning. This can create overlapping address problems. For example, if two companies both use 10.0.0.0/8 internally and then connect their networks together, there will be duplicate addresses, which complicates routing and connectivity.

Another issue appears when using addresses that are not designated as private for internal use. If a network uses a random public range internally, and that same range is used by a real organization on the internet, there can be routing conflicts. This can make it impossible to reach the legitimate external network that owns those addresses.

To avoid these problems, it is important to stay within the RFC 1918 private ranges for internal addressing, unless there is a specific and well planned reason not to, and to coordinate address plans when connecting separate organizations or sites.

It is also important to understand that having a private IP does not magically protect a device if it can still reach the internet through some form of translation, or if other networks can reach it through VPNs or tunnels. Proper security controls must still be applied based on risk.

Recognizing Public and Private IPs in Practice

Everyday networking tools and management tasks often require you to quickly recognize whether an IP is public or private. When you check the IP address of your phone or computer inside a home network, you will usually see an address in one of the private ranges, commonly something like 192.168.1.x or 10.0.0.x.

If you use an external website to show “your IP,” you will instead see the public address used by your router or modem. These two values are usually different, because of NAT. Inside corporate networks, you may see larger private address plans where entire departments or buildings are assigned their own subranges under 10.0.0.0/8 or 172.16.0.0/12.

Recognizing an address like 8.8.8.8 as public, and 192.168.10.25 as private, becomes second nature with practice. This helps when troubleshooting connectivity, interpreting logs, or designing address plans. If a host with a private IP cannot be reached from the public internet, this is expected unless some combination of NAT, port forwarding, or VPN has been set up. On the other hand, if a host with a public IP is directly reachable, you know it is not hidden behind private addressing.

Summary of Public vs Private IP Behavior

Putting these ideas together, the roles of public and private IP addresses can be summarized by their basic behaviors.

Public IPs are globally unique, routable over the internet, and assigned by official authorities and ISPs. They are used for public facing routers, servers, and services that must be reachable from outside. Use of public IPs must be coordinated and is limited by availability.

Private IPs are meant only for internal networks, can be reused by many different organizations, and are not routed on the public internet. They provide a flexible pool for numbering internal devices and work together with NAT to give those devices access to external networks.

Understanding this separation is central to IP design. It affects how you connect internal devices to the internet, which addresses you choose for internal segments, and how you secure the boundaries between your local networks and the rest of the world.