Public vs Private IP Addresses: Ranges, NAT, and Security

Not all IP addresses can be reached over the public Internet. The Internet Engineering Task Force (IETF) divided IPv4 address space into two main categories: Public IP addresses and Private IP addresses.

What is a Public IP Address?

A public IP address is a globally unique number assigned to a network interface connected directly to the open Internet.

• Allocated by Regional Internet Registries (such as ARIN, RIPE NCC, APNIC).
• Directly routable across global BGP border routers.
• Used by websites, cloud servers, email relays, and the WAN (external) port of home broadband routers.
• Visible to any remote web server you connect to.

What is a Private IP Address?

A private IP address is an address reserved exclusively for local area networks (LANs), homes, offices, and internal cloud VPCs.

• Governed by RFC 1918 in IPv4 and RFC 4193 in IPv6.
• Strictly non-routable on the public Internet: Internet core routers are programmed to instantly discard packets with private destination IPs.
• Can be reused infinitely across different private networks without conflict (e.g. millions of homes simultaneously use 192.168.1.1).

RFC 1918 Private Address Blocks

Class / Name	Network Prefix (CIDR)	Address Range	Total Addresses	Typical Use Case
Class A	10.0.0.0/8	10.0.0.0 – 10.255.255.255	16,777,216	Large enterprise networks, AWS VPCs, data centers
Class B	172.16.0.0/12	172.16.0.0 – 172.31.255.255	1,048,576	Mid-sized business campuses and virtual machine networks
Class C	192.168.0.0/16	192.168.0.0 – 192.168.255.255	65,536	Small home routers, coffee shop Wi-Fi, local subnets

How NAT Bridges the Divide

Because private IPs cannot travel across the Internet, how do hundreds of computers in an office browse the web simultaneously using just one public IP?

The answer is Network Address Translation (NAT), running on your router or gateway:

1. When your laptop (192.168.1.45) sends a request to ip-address-lookup.com, the packet hits your router.
2. The router modifies the packet header: it replaces the private source IP (192.168.1.45) with the router’s single public WAN IP (e.g., 203.0.113.19), and maps the internal connection to an ephemeral port (e.g., port 54123).
3. When the web server replies to 203.0.113.19:54123, the router consults its NAT state table, restores the original destination IP 192.168.1.45, and forwards the packet to your laptop.

This process provides natural perimeter isolation: outside attackers on the public Internet cannot directly initiate unsolicited connections to private internal devices behind a NAT firewall.