A private IP address is one from a block reserved for use inside local networks, which the internet does not route: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. A public IP address is globally routable and is what websites see; your router uses NAT to let every device behind its one public address share it.
To see your private address, run ipconfig on Windows, ip addr on Linux, or ipconfig getifaddr en0 on macOS. Your public address is shown on your router's status page, or by any "what is my IP" lookup.
The private ranges, exactly
RFC 1918 reserves three blocks for private networks:
| Block | Address range | Number of addresses |
|---|---|---|
| 10.0.0.0/8 | 10.0.0.0 to 10.255.255.255 | 16,777,216 |
| 172.16.0.0/12 | 172.16.0.0 to 172.31.255.255 | 1,048,576 |
| 192.168.0.0/16 | 192.168.0.0 to 192.168.255.255 | 65,536 |
The number after the slash is how many leading bits are fixed. A /12 fixes 12 bits and leaves 32 − 12 = 20 bits free, so it holds 220 = 1,048,576 addresses. The common mistake is with the middle block: 172.16.0.0/12 runs up to 172.31.255.255, so 172.20.5.9 is private but 172.32.0.1 is public.
The RFC says routing information about private networks "shall not be propagated on inter-enterprise links," which is why these addresses can be reused by every home and office at once without conflict.
How NAT lets private devices reach the internet
Your provider gives your router one public IPv4 address. Your laptop, phone and TV get private addresses from the router. When the laptop opens a website, the router rewrites the outgoing packet's source from the laptop's private address to its own public address, keeps a table entry recording which inside device and port made the request, and uses that table to send the reply back to the right device. That translation is Network Address Translation (NAT).
Two side effects follow. First, every device in your home appears to websites as the same public address. Second, nothing outside can start a connection to a device inside unless the router has a rule (port forwarding) saying where to send it.
CGNAT: when even your router has a shared address
IPv4 has only about 4.3 billion addresses (232), so many providers now put customers behind a second layer of NAT in their own network, called carrier-grade NAT (CGNAT). RFC 6598 reserved a block for the links between that equipment and customers' routers: "The Shared Address Space address range is 100.64.0.0/10," which is 100.64.0.0 to 100.127.255.255.
The RFC is explicit that this block "is distinct from RFC 1918 private address space" and is meant for provider networks, not your home LAN.
To check whether you're behind CGNAT, compare two numbers:
- The WAN or internet address shown on your router's status page.
- The public address a "what is my IP" lookup shows.
If the router's WAN address is in 100.64.0.0/10 or an RFC 1918 range, or simply doesn't match the lookup, there is NAT upstream of you. Port forwarding on your router won't work in that case; ask your provider whether a dedicated public address is available.
Special addresses you will run into
| Block | Name (RFC 6890) | What it means for you |
|---|---|---|
| 127.0.0.0/8 | Loopback | The computer itself. 127.0.0.1 (localhost) never leaves the machine. |
| 169.254.0.0/16 | Link Local | The device assigned itself an address because it got none from DHCP. |
| 100.64.0.0/10 | Shared Address Space | Carrier-grade NAT inside your provider's network. |
| ::1/128 | Loopback Address (IPv6) | IPv6 equivalent of 127.0.0.1. |
| fe80::/10 | Linked-Scoped Unicast (IPv6; spelled this way in the RFC) | Automatic local-only IPv6 address on every interface. Normal. |
| fc00::/7 | Unique-Local (IPv6) | IPv6 addresses for use inside a network. |
Why you got a 169.254.x.x address
A 169.254 address almost always means "DHCP failed." When a device can't get an address from a DHCP server (usually your router), it picks one itself from the link-local block. RFC 3927 says hosts choose addresses pseudo-randomly "in the range from 169.254.1.0 to 169.254.254.255 inclusive," and that a router "MUST NOT forward a packet with an IPv4 Link-Local source or destination address." So a device with only a 169.254 address can talk to neighbours on the same link but can't reach the internet.
Fixes, in order: check the cable or Wi-Fi connection, restart the router, then request a new lease (ipconfig /release then ipconfig /renew on Windows). If a computer is wired directly to another computer with no router between them, a 169.254 address is expected and fine.
How to find your private address
Windows (Command Prompt or PowerShell):
ipconfig
Real output from one adapter on the machine this article was checked on:
Ethernet adapter Ethernet 2:
Connection-specific DNS Suffix . :
Link-local IPv6 Address . . . . . : fe80::2e05:1023:2486:a0a1%29
IPv4 Address. . . . . . . . . . . : 192.168.56.1
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
Look for the adapter that has a Default Gateway: that is the one connected to your router. Adapters for VPNs and virtual machines (like the one above, which has no gateway) also appear in the list. Microsoft notes that ipconfig shows whether settings came from DHCP or Automatic Private IP Addressing (APIPA), Windows' name for the 169.254 fallback; ipconfig /all shows full detail.
Linux:
ip addr
Each address is followed by a scope. The ip-address(8) manual defines global as "globally valid" (a normal LAN or public address), link as valid only on that link, and host as "valid only inside this host" (loopback).
macOS:
ipconfig getifaddr en0
This prints the IPv4 address of the first network service on interface en0. If it prints nothing, that interface has no address; try en1, or open System Settings → Network and select the active connection.
How to find your public address
Your computer doesn't know its public address when it's behind NAT; only the router (or the provider's equipment) holds it. Two ways to see it:
- Open your router's admin page (usually at its gateway address, such as 192.168.1.1) and look for WAN, Internet or Connection status.
- Search "what is my IP" or visit any IP-echo site. It reports the address your traffic arrives from, which is the one that matters for anything outside your network.
Your public address can change, because most home connections get it dynamically from the provider. When a domain name is involved, DNS translates names to these public addresses; how DNS works covers that step.
Frequently asked questions
- Is 192.168.1.1 a public or private IP address?
- Private. Every address from 192.168.0.0 to 192.168.255.255 is in the 192.168.0.0/16 block that RFC 1918 reserves for private networks, so it can't be reached directly from the internet. 192.168.1.1 and 192.168.0.1 are common default addresses for home routers on the local side.
- Can someone find my location from my private IP address?
- No. Private addresses are reused in millions of separate networks and are not routed on the internet, so a 192.168.x.x or 10.x.x.x address identifies a device only within its own local network. Websites see your public address, which is assigned by your provider.
- Why does my router show a 100.64.x.x address on its internet side?
- That address is in 100.64.0.0/10, the Shared Address Space reserved by RFC 6598 for carrier-grade NAT. Your provider is sharing one public IPv4 address among several customers, so your router does not have a public address of its own. This usually makes incoming connections, such as port forwarding, impossible without help from the provider.
- Do private addresses exist in IPv6?
- Yes. IPv6 reserves fc00::/7 for Unique Local Addresses, used inside a network, and fe80::/10 for link-local addresses that every interface configures automatically. Devices usually also have a globally routable IPv6 address alongside these, which you can see in ipconfig or ip addr output.
Sources
- RFC 1918: Address Allocation for Private Internets
- RFC 6598: IANA-Reserved IPv4 Prefix for Shared Address Space
- RFC 3927: Dynamic Configuration of IPv4 Link-Local Addresses
- RFC 6890: Special-Purpose IP Address Registries
- Microsoft Learn: ipconfig
- Linux man-pages: ip-address(8)
- SS64: ipconfig (macOS)