Private IP address ranges explained

Addresses reserved for local networks

Three IPv4 blocks are reserved for private networks by RFC 1918. Anyone can use them inside a home, office or data center, so the same private address exists in millions of networks at once.

Because they are not unique, private addresses are not routed on the public internet. A router translates them to its public address before traffic leaves the network. That is why IPNIXA never shows a 192.168 address as your public IP.

Other special IPv4 ranges

Several more blocks are reserved for specific purposes. Recognizing them makes network settings and error messages much easier to read.

The IPv6 equivalents

IPv6 has unique local addresses in fc00::/7, in practice beginning with fd, for internal networks. Every IPv6 interface also has a link-local address beginning with fe80, used only on the local link, and ::1 is the IPv6 loopback address.

Unlike in most IPv4 homes, IPv6 devices usually also receive globally routable addresses directly. Privacy extensions rotate the device-specific part of those addresses, and the router’s firewall still decides which incoming connections are allowed.

• fd00::/8 (from fc00::/7): unique local addresses for internal use.
• fe80::/10: link-local addresses, present on every IPv6 interface.
• ::1: loopback, the IPv6 version of 127.0.0.1.
• 2001:db8::/32: reserved for documentation examples.

How to tell whether an address is private

You can classify most IPv4 addresses by their first one or two numbers.

1. If it starts with 10, it is private.
2. If it starts with 172, look at the second number: 16 to 31 means private; anything else (for example 172.217) is public address space.
3. If it starts with 192.168, it is private.
4. If it starts with 100 and the second number is 64 to 127, it is the carrier-grade NAT range.
5. If it starts with 169.254, the device gave itself an address because DHCP failed.
6. For IPv6, fd… and fe80… are local; addresses starting with 2 or 3 are normally global.

Why this matters in practice

If a guide asks for “your IP” to connect to a device at home from elsewhere, a private address will not work from outside the network; port forwarding, a VPN or a remote-access service is needed. Inside the network, the private address is the right one.

A 169.254 address is a troubleshooting clue: the device is connected to the network but received no configuration. Restart the router, reconnect to the network, or check that the router’s DHCP server is enabled.

Choosing a range for your own network

Address conflicts happen when two networks joined by a VPN use the same private range. Choosing a less common block, such as a random 10.x.y.0/24, for a home lab reduces that risk.

• Avoid 192.168.0.0/24 and 192.168.1.0/24 if you often connect to other networks over a VPN — they are the most common defaults.
• Never use public address space you do not own, even inside a lab; you will not be able to reach the real owner’s services.
• Keep 100.64.0.0/10 for providers and overlay VPNs that are designed to use it.