PlayInfoBox

Home /Network /Private IP Address Ranges (RFC 1918) Explained

Private IP Address Ranges (RFC 1918) Explained

That address starting with 192.168 on your router — here's why it's always in that range.

Why private IP addresses exist

Public IPv4 addresses are a limited resource — there are only about 4.3 billion possible addresses, nowhere near enough for every device on Earth. RFC 1918 sets aside blocks of addresses that are never routed on the public internet and are reused, in isolation, inside millions of separate private networks. Your router uses NAT (Network Address Translation) to hide all of your home devices behind a single public IP address.

The 10.0.0.0/8 range

Running from 10.0.0.0 to 10.255.255.255, this is the largest private block, with about 16.7 million addresses. It's mainly used by large enterprises, data centers, and internet service providers for sizeable internal networks — you'll rarely see it as a home router default, but it comes up often in corporate VPNs.

The 172.16.0.0/12 range

Spanning 172.16.0.0 to 172.31.255.255, this block provides roughly 1.05 million addresses and is a common choice for mid-sized company networks. It's also familiar to developers: Docker's default bridge network typically uses a slice of this range, such as 172.17.0.0/16.

The 192.168.0.0/16 range

Covering 192.168.0.0 to 192.168.255.255, this is the range home routers almost always default to. If you've ever opened a router's admin page at an address like 192.168.0.1 or 192.168.1.1, this is the block you were in — sized just right for homes and small offices.

Other special ranges worth knowing

127.0.0.0/8 is the loopback range, used by a device to talk to itself (127.0.0.1, aka localhost) and never leaves the machine. 169.254.0.0/16 is the link-local range an operating system assigns automatically when it can't reach a DHCP server (APIPA) — seeing an address in this range usually signals a connection problem. Separately, 100.64.0.0/10 is a shared address space (not part of RFC 1918) commonly used by ISPs for carrier-grade NAT (CGNAT), which pools many subscribers behind one public IP.

A real-world situation worth knowing about

Because private IP addresses are only meaningful within their own network, two completely separate networks can use the same range (say, both using 192.168.0.0/24) without any issue — until you connect them. Working remotely over a VPN that bridges your home network and your office network can cause a range conflict, where it's unclear which 192.168.0.10 is meant, breaking connectivity. Changing one side's internal range to a different private block, like 172.16.0.0/12, usually resolves it.

How big each private block really is

The three RFC 1918 blocks differ a great deal in size. 10.0.0.0/8 holds 16,777,216 addresses, 172.16.0.0/12 holds 1,048,576, and 192.168.0.0/16 holds 65,536. In practice, networks rarely use a whole block as one flat network. A /24 subnet such as 192.168.1.0/24 has 256 addresses, of which 254 can be assigned to devices, because the first and last are reserved for the network and broadcast addresses. Splitting a large block into many subnets lets one organization keep, say, offices, servers, and guest Wi-Fi separate.

Typical home router addresses

Router makers have settled on a few popular defaults. 192.168.0.1 and 192.168.1.1 are very common for consumer routers, while some providers' equipment uses 10.0.0.1 or 192.168.100.1. The exact value depends on the brand and model, and your device's label or manual lists it. On Windows you can run ipconfig and read the default gateway, on macOS or Linux you can use the network settings or a route command, and the gateway address is the router's private IP on your network.

Choosing a range for your own network

If your network will ever connect to another one through a VPN or cloud link, avoid the most common defaults, 192.168.0.0/24 and 192.168.1.0/24, because those are exactly the ranges other networks are likely to use. A less common choice such as 10.42.0.0/16 or 172.20.0.0/16 reduces the chance of a clash. Write down which ranges you use for each site, and give each one its own non-overlapping subnet from the start, since renumbering later means touching every device.

The IPv6 counterpart: unique local addresses

IPv6 has its own equivalent of private addressing, called unique local addresses (ULA), defined in RFC 4193 within fc00::/7 and used in practice under fd00::/8. They are meant for local communication and are not routed on the public internet. Because IPv6 has plenty of public addresses, most devices also get a global address, and the main reason to use ULA is stable internal addressing that does not change when the ISP prefix changes. Link-local IPv6 addresses beginning with fe80:: are used for neighbor communication on a single link.

DHCP, reservations, and static addresses

Most private networks hand out addresses automatically with DHCP, which gives each device a lease from a configured pool. For devices that others need to find reliably, like printers, NAS boxes, or servers, you can create a DHCP reservation so the router always gives the same address to a particular device, or configure a static address outside the DHCP pool. Setting static addresses inside the pool risks duplicates, so keep the two clearly separated.

Private addressing is not the same as security

NAT often blocks unsolicited incoming connections as a side effect, but it was designed to conserve addresses, not to protect devices. A real firewall applies explicit rules and tracks sessions, and good practice is to run one regardless of the addressing scheme. Also remember that devices on the same private network can reach each other, so a compromised laptop or camera can scan the rest of the network.

Why port forwarding sometimes fails: CGNAT

If your router's WAN address starts with 100.64 through 100.127, or is a private address, your provider is likely using carrier-grade NAT, so your router does not own a public IP address. Port forwarding on your router then cannot make a service reachable from outside, because another NAT sits in front. Typical options are asking the provider for a public address (sometimes for a fee), using a VPN or tunnel service that does the reaching for you, or using IPv6 where the provider supports it.

How NAT makes private addresses work on the internet

Private IP addresses can't be routed across the public internet on their own — routers along the way would have no idea which of the millions of networks using 192.168.1.10 you meant. Network Address Translation (NAT) solves this by rewriting the source address of outgoing traffic to your router's single public IP address, then tracking which internal device each response belongs to. This is also why a device outside your network normally can't just start a connection to a device inside it — traffic has to be initiated from the inside, or explicitly forwarded through a router setting.

Spotting a private address at a glance

If an address starts with 192.168, 10., or falls between 172.16 and 172.31, it's private and only valid on that specific local network — useful to recognize instantly when troubleshooting, reading a router's device list, or reviewing logs. Any other address is very likely a public, internet-routable one, though a handful of other reserved ranges (like loopback and link-local) exist for special purposes rather than general-purpose networking.

Troubleshooting with private addresses

When a device cannot reach the internet, its address is often the first clue. A 169.254.x.x address suggests the device failed to get a DHCP lease, so check the cable or Wi-Fi connection and the router's DHCP service. An address in the wrong subnet, for instance 192.168.0.20 on a network that uses 192.168.1.0/24, usually points to a static setting left over from another network. Two devices with the same address cause intermittent dropouts, and the router's client list can help you find the duplicate.

Frequently Asked Questions

Can a private IP address connect directly to the internet?

No — private IP ranges are deliberately excluded from internet routing, so a device with only a private address can't reach the internet on its own. A router performs NAT to translate the private address to a public one, which is what actually makes the connection possible.

Why are there three separate private ranges instead of just one?

Having ranges of different sizes lets a network choose one that fits its scale. A large enterprise or ISP with huge numbers of devices might use the vast 10.0.0.0/8 range, while a home network with a handful of devices is comfortably served by the much smaller 192.168.0.0/16.

Can two different home networks have the same private IP range?

Yes, and almost all of them do. Because private addresses are never routed on the public internet, millions of homes can use 192.168.1.0/24 at once without conflict. The problem only appears when the networks are connected, for instance through a VPN.

How do I find my private IP address?

On Windows, open a command prompt and run ipconfig. On macOS or Linux, use the network settings or the ifconfig or ip addr commands. On phones, look in the Wi-Fi details for the connected network. Your public IP is different and is what websites see; a search for "what is my IP" shows it.

Is 172.32.0.0 a private address?

No. The private block is 172.16.0.0 through 172.31.255.255, so 172.32.0.0 and above is outside it and is a public address. This is a classic trap because the whole 172 range is sometimes assumed to be private.