Public IP vs Private IP Addresses

A public IP address is the address the whole internet sees for your connection. Your ISP assigns it, and no other network uses it at the same time.

A public IP address (also called an external IP address) is a globally unique numerical identifier assigned to your internet connection by your Internet Service Provider (ISP). Public IPs are drawn from address pools allocated to ISPs by one of the five Regional Internet Registries: ARIN (Americas), RIPE NCC (Europe, Middle East, and Central Asia), APNIC (Asia-Pacific), LACNIC (Latin America and Caribbean), and AFRINIC (Africa).

Public IP addresses are routable across the open internet — any device anywhere can initiate a direct connection to a public IP. Web servers, email servers, and any internet-facing service require a public IP. For home users, the ISP assigns one public IP to the router; all devices on the local network share it for outbound internet communication.

Public IPs may be static (fixed permanently, required by servers and services that must be consistently reachable) or dynamic (reassigned periodically by the ISP). Most residential connections use dynamic public IPs, which may change on reconnection or after an ISP-defined lease period.

A private IP address identifies a device inside your home or office network. It comes from the RFC 1918 ranges and is never routed on the internet.

A private IP address (also called an internal or local IP address) is a non-routable address used exclusively within a local network. Defined in RFC 1918 (IETF, September 1996), private address space allows every organization and household to assign unique identifiers to every internal device without consuming globally registered public IP space.

Private IPs are assigned by your router, typically via DHCP. Because standard internet routers never forward RFC 1918 addresses, the same private IP can exist simultaneously across millions of separate local networks worldwide without conflict. Your neighbor's device may hold 192.168.1.100 — identical to an address on your network — and neither interferes with the other.

Private IP addresses are not inherently secure. The non-routability of RFC 1918 space limits external exposure, but security within a private network depends on firewalls, NAT configuration, and access controls — not on the address range alone.

RFC 1918 reserves three blocks of IPv4 address space for private use. These blocks were originally drawn from the legacy Class A, B, and C systems and are expressed today using CIDR (Classless Inter-Domain Routing) notation. Any address within these three ranges is, by definition, a private IP and will not be forwarded by any standard internet router.

The 192.168.0.0/16 range is the most common in home networks — most consumer routers default to a gateway address of 192.168.0.1 or 192.168.1.1. Large enterprise networks typically use the 10.0.0.0/8 range for its capacity of over 16 million addresses. The 172.16.0.0/12 range is common in medium-sized corporate and data centre environments.

Carrier-grade NAT (CGNAT) puts many ISP customers behind one public IP. If your router’s WAN address is between 100.64.0.0 and 100.127.255.255, your ISP is using it.

Carrier-Grade NAT (CGNAT), defined in RFC 6598, introduces a separate address range outside RFC 1918 that ISPs use when they cannot provide each customer with a true public IP: 100.64.0.0/10 (100.64.0.0 to 100.127.255.255), providing 4,194,304 addresses. This range is formally called "shared address space."

When an ISP deploys CGNAT, your router receives an address from the 100.64.0.0/10 range instead of a genuine public IP. From the router's perspective, this looks like a public IP — but it is non-routable on the open internet. The ISP then applies a second NAT at the carrier level, mapping this address to a real public IP shared across multiple customers.

CGNAT is increasingly common as IPv4 exhaustion deepens. Its practical effects:

• Port forwarding failures — your router cannot accept incoming connections because it does not hold a true public IP.
• Peer-to-peer disruption — game servers, VoIP, and BitTorrent protocols requiring direct inbound connections do not function reliably.
• Home VPN limitations — a VPN server hosted behind CGNAT is not directly reachable from the internet.
• Geolocation displacement — the public IP visible externally belongs to the ISP's CGNAT device, not your router's location.

To detect CGNAT: compare your router's WAN IP address to the public IP shown on whatismyipnow.com. If the two addresses differ, your ISP is applying CGNAT.

NAT lets every device on your network share one public IP: the router replaces each device’s private address with the public one on the way out, and reverses it on the way back.

Network Address Translation (NAT), defined in RFC 3022, is the mechanism that allows devices holding private RFC 1918 addresses to communicate with the internet. When an internal device sends a packet to an external server, the router performs three steps:

1. Records the source private IP and source port in its NAT translation table.
2. Replaces the source private IP with the router's public IP and assigns a unique source port to track the connection.
3. Forwards the modified packet onto the internet.

When the response arrives, the router checks the NAT table, reverses the translation, and delivers the packet to the correct internal device. The entire process is transparent to both the internal device and the remote server.

The most common implementation is Port Address Translation (PAT), also called NAT overload: a single public IP serves thousands of simultaneous private connections by differentiating them via unique source port assignments. A home router with 30 connected devices requires only one public IP for all outbound internet activity.

NAT has a secondary effect on IPv4 exhaustion: entire networks of devices share one public IP rather than each requiring a separate registered address. This is a primary reason IPv4 has remained viable despite the IANA pool exhaustion in 2011.

127.0.0.1, the loopback address, always means “this device”. Traffic sent to it never leaves the computer.

The loopback address 127.0.0.1 — and the full 127.0.0.0/8 range, per RFC 5735 — is distinct from RFC 1918 private addresses but shares one key property: it is non-routable and is never transmitted to any physical network interface.

Traffic sent to any address in 127.0.0.0/8 is handled entirely within the local host's network stack. It never reaches the LAN or the internet. This makes loopback the standard choice for local service communication (a web server bound to 127.0.0.1 accepts connections only from the same machine), development environments, and software testing without network exposure.

The critical distinction: RFC 1918 addresses travel over the local network between devices on the same LAN. The loopback address never leaves the individual host. Both are non-internet-routable — but loopback is host-scoped, while RFC 1918 is network-scoped.