Public vs Private IP Address: RFC 1918, NAT, CGNAT & Security Explained
The complete guide to public and private IP addresses — RFC 1918 ranges, how NAT works, CGNAT, security implications, and real-world use cases.
What Is a Public IP Address?
A public IP address is an IP address that is globally unique and routable on the internet. Any device that directly communicates with the public internet — your home router's WAN interface, a web server, a CDN node — must have a public IP. Public IPs are allocated by IANA through the regional registries (ARIN, RIPE, APNIC, LACNIC, AFRINIC) and then distributed by ISPs to their customers.
When you visit a website, the web server sees your public IP address as the source — not the private IP of your laptop inside your home network. This translation is performed by NAT (Network Address Translation) in your router. Check your current public IP with our My IP Address tool.
What Is a Private IP Address?
Private IP addresses are defined in RFC 1918 as three reserved ranges that are not routed on the public internet:
10.0.0.0 – 10.255.255.255(10.0.0.0/8) — 16,777,216 addresses172.16.0.0 – 172.31.255.255(172.16.0.0/12) — 1,048,576 addresses192.168.0.0 – 192.168.255.255(192.168.0.0/16) — 65,536 addresses
These ranges can be used by anyone, anywhere — a million different organizations can all use 192.168.1.0/24 internally without conflict, because private addresses never appear on the public internet. Calculate any private IP range with our IP Range Calculator.
How NAT Bridges Private and Public IPs
NAT (Network Address Translation) is the technology that allows many private-addressed devices to share a single public IP. When your laptop (192.168.1.5) sends a request to Google's server (142.250.80.46):
- The packet leaves your laptop with source IP 192.168.1.5, destination 142.250.80.46.
- Your router rewrites the source IP to its public IP (e.g. 203.0.113.42) and records the mapping in a NAT table.
- The packet travels the internet with source 203.0.113.42.
- Google responds to 203.0.113.42.
- Your router looks up the NAT table, translates back to 192.168.1.5, and delivers to your laptop.
This is why Google sees your router's public IP, not your laptop's private IP. NAT both conserves public IPs (billions of devices sharing a few billion public IPs) and provides a layer of security (devices behind NAT are not directly reachable from the internet).
Public vs Private IP: Full Comparison
| Property | Public IP | Private IP |
|---|---|---|
| Globally unique? | Yes | No (reusable) |
| Internet routable? | Yes | No |
| Assigned by | ISP (from RIR allocation) | Router DHCP or manually |
| Ranges | All non-reserved IPv4 | 10/8, 172.16/12, 192.168/16 |
| Visible to websites? | Yes | No (NAT hides it) |
| Direct internet access? | Yes | No (via NAT) |
| Used for | Servers, routers, public services | LAN, home networks, enterprise internal |
| Cost | Often charged by ISP | Free (RFC 1918) |
Special Private-like Ranges
Beyond RFC 1918, several other ranges are non-routable or have special use:
127.0.0.0/8— Loopback (localhost). Never leaves your device.169.254.0.0/16— Link-local / APIPA. Auto-assigned when DHCP fails. Cannot be routed.100.64.0.0/10— Carrier-Grade NAT (CGN/CGNAT). Used by ISPs for subscriber-to-ISP translation — a second layer of NAT between your home router and the internet.
Can Two Devices Have the Same Private IP?
Yes — on different networks. Every home router assigns 192.168.1.1 internally, and millions of home networks simultaneously use 192.168.1.0/24 without issue, because private addresses never appear on the public internet. Within the same network, duplicate IPs cause an IP conflict — both devices temporarily lose connectivity.
Security: Private vs Public Exposure
Devices with public IPs are directly reachable from the internet — they must be hardened with firewalls, patched regularly, and monitored. Devices with only private IPs behind NAT are not directly reachable from outside without port forwarding — NAT provides implicit firewall-like protection. However, private IPs can still be compromised via phishing, malicious downloads, or internal network attacks — NAT is not a security substitute for proper firewalling.
For checking if your public IP is on any blocklist, use our Blacklist Check tool. To understand your full public IP profile, use IP Lookup.
Related Tools & Guides
My IP Address | IP Lookup | IP Range Calculator | CIDR Calculator | What Is an IP Address? | Static vs Dynamic IP | How to Hide Your IP