Private IP Address Ranges: Complete Reference Guide (RFC 1918)

Last Updated: October 2026

What Are Private IP Addresses?

A private IP address is an address from a specially reserved range that is used exclusively within local area networks (LANs) — your home network, office network, data center, or any internal network. Private addresses are defined in RFC 1918, published by the Internet Engineering Task Force (IETF) in 1996, and they were introduced to solve a critical problem: the limited supply of IPv4 addresses.

IPv4 provides approximately 4.3 billion unique addresses. That sounds like a lot, but with billions of internet-connected devices worldwide, there are simply not enough public addresses to give every device a unique one. Private addressing combined with Network Address Translation (NAT) solves this by allowing millions of organizations to independently reuse the same address ranges internally while sharing a much smaller number of public addresses for internet access.

The key characteristic of private IP addresses is that they are not routable on the public internet. Internet backbone routers are configured to drop packets with private source or destination addresses. This means private addresses only have meaning within the local network where they are assigned, and two completely separate networks can use identical private address schemes without any conflict.

The Three RFC 1918 Private Ranges

RFC 1918 defines exactly three blocks of IPv4 address space for private use. Each block serves different scale requirements:

Class A: 10.0.0.0/8

Range: 10.0.0.0 – 10.255.255.255
Subnet Mask: 255.0.0.0
Total Addresses: 16,777,216 (2²⁴)
Usable Host Addresses: 16,777,214

The 10.0.0.0/8 block is the largest private range, providing over 16 million addresses in a single contiguous block. It is the preferred choice for large enterprises, cloud providers, data centers, and organizations that need extensive subnetting flexibility. Companies like Amazon, Google, and Microsoft use 10.x.x.x addressing extensively within their internal infrastructure. ISP gateways from providers like Comcast/Xfinity and AT&T also commonly use this range (e.g., 10.0.0.1 as the default gateway).

Because of its size, the 10.0.0.0/8 range can be subdivided into thousands of smaller subnets. For example, a large organization might use 10.1.0.0/16 for its headquarters, 10.2.0.0/16 for a branch office, and 10.3.0.0/16 for a data center, with each /16 subnet supporting up to 65,534 hosts.

Class B: 172.16.0.0/12

Range: 172.16.0.0 – 172.31.255.255
Subnet Mask: 255.240.0.0
Total Addresses: 1,048,576 (2²⁰)
Usable Host Addresses: 1,048,574

The 172.16.0.0/12 block provides roughly one million addresses and is commonly used in medium-to-large corporate networks, educational institutions, and cloud environments. Docker and Kubernetes use subnets within this range by default for container networking (Docker's default bridge network uses 172.17.0.0/16).

A common point of confusion with this range is its boundaries. It does not include all of 172.x.x.x — only 172.16.0.0 through 172.31.255.255. Addresses like 172.15.0.1 or 172.32.0.1 are public IP addresses, not private. This is because the /12 prefix only covers the range where the second octet is between 16 and 31.

Class C: 192.168.0.0/16

Range: 192.168.0.0 – 192.168.255.255
Subnet Mask: 255.255.0.0
Total Addresses: 65,536 (2¹⁶)
Usable Host Addresses: 65,534

The 192.168.0.0/16 block is the most recognizable private range because it is used by the vast majority of home routers and small office networks. When you see an IP address starting with 192.168, it is almost certainly a device on a local network. Most consumer routers default to either 192.168.0.0/24 or 192.168.1.0/24 as their LAN subnet, providing 254 usable host addresses — more than enough for a typical household.

Despite being the smallest RFC 1918 block, the 192.168.0.0/16 range still provides 256 possible /24 subnets (192.168.0.0/24 through 192.168.255.0/24), each supporting 254 hosts. This makes it adequate for small businesses that need to segment their network into departments or VLANs.

Private vs. Public IP Addresses — Comparison

Understanding the differences between private and public IP addresses is fundamental to networking. Here is a side-by-side comparison:

Other Reserved (Non-Public) Address Ranges

Beyond RFC 1918, several other IPv4 ranges are reserved for special purposes and are not routable on the public internet:

CGNAT Range: 100.64.0.0/10 (RFC 6598)

Range: 100.64.0.0 – 100.127.255.255
Total Addresses: 4,194,304

The Carrier-Grade NAT (CGNAT) range was defined in RFC 6598 to give ISPs a dedicated address space for performing NAT at the provider level. When an ISP does not have enough public IPv4 addresses for every subscriber, it assigns CGNAT addresses to customer equipment and performs NAT at a centralized point within its own network. This means your traffic passes through two layers of NAT: one in your home router (private to CGNAT) and one in the ISP's infrastructure (CGNAT to public).

CGNAT is increasingly common as IPv4 addresses become scarcer. If your What Is My IP tool shows a public IP that differs from the WAN IP displayed on your router's status page, you are likely behind CGNAT. This can cause issues with port forwarding, hosting servers, and peer-to-peer applications because you do not have a dedicated public IP address.

Loopback: 127.0.0.0/8

Range: 127.0.0.0 – 127.255.255.255
Most Common: 127.0.0.1 (localhost)

The entire 127.0.0.0/8 block is reserved for loopback. Packets sent to any address in this range never leave the device — they are looped back internally by the networking stack. The address 127.0.0.1 is universally known as localhost and is used by developers to test network services running on the same machine. Any of the 16 million addresses in this block works as a loopback address, though 127.0.0.1 is by far the most commonly used.

Link-Local / APIPA: 169.254.0.0/16

Range: 169.254.0.0 – 169.254.255.255
Usable range: 169.254.1.0 – 169.254.254.255 (first and last /24 blocks are reserved)

Link-local addresses are automatically assigned by a device when it is configured for DHCP but cannot reach a DHCP server. On Windows, this mechanism is called APIPA (Automatic Private IP Addressing). If you see a 169.254.x.x address on your device, it means DHCP failed — your device could not contact the router to obtain a proper IP address.

Link-local addresses allow basic communication between devices on the same physical network segment even without a DHCP server or manual configuration. However, they cannot be routed, even within a private network, so internet access and access to other subnets will not work. Seeing a 169.254.x.x address is almost always a sign that something is wrong with your network connection, DHCP server, or cable.

How NAT Translates Private to Public

Network Address Translation (NAT) is the technology that makes private IP addressing work. Without NAT, devices with private addresses could never communicate with the internet because private addresses are dropped by public routers. Here is how NAT works step by step:

1. Outbound request: Your laptop (private IP 192.168.1.100) sends a request to 93.184.216.34 (example.com). The packet's source address is 192.168.1.100.
2. Router rewrites the source: Your router intercepts the packet, replaces the source address with its own public IP (e.g., 203.0.113.45), and assigns a unique source port number (e.g., 50001). It records this mapping in its NAT translation table.
3. Packet reaches the server: The web server sees the request coming from 203.0.113.45:50001 and sends the response back to that address.
4. Router translates back: When the response arrives, the router looks up port 50001 in its NAT table, finds that it maps to 192.168.1.100, replaces the destination address, and forwards the packet to your laptop.

This process is called PAT (Port Address Translation) or NAT overload because it uses port numbers to multiplex many private addresses through a single public address. It is the most common form of NAT used in home and small office routers. A single public IP can support tens of thousands of simultaneous connections from different devices, with each connection distinguished by a unique port number in the NAT table.

IPv6 Private Address Equivalents

IPv6 was designed to eliminate the need for private addressing and NAT by providing an astronomically large address space (2¹²⁸ addresses). However, IPv6 still includes address types that serve functions similar to private IPv4 addresses:

Unique Local Addresses (ULA): fc00::/7

Range: fc00:: – fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
Practical range: fd00::/8 (the fc00::/8 half is not yet defined for use)

Unique Local Addresses are the IPv6 equivalent of RFC 1918 private addresses. They are intended for use within a site or organization and are not routed on the global internet. ULAs begin with fd followed by a 40-bit random identifier, making accidental collisions between different organizations extremely unlikely. For example, a valid ULA might look like fd12:3456:789a::1.

Unlike IPv4 private addressing, ULAs are not necessary for address conservation in IPv6 — there are more than enough global addresses. Instead, ULAs are used when an organization wants internal addressing that remains stable regardless of ISP changes, or when devices need to communicate locally even if the internet connection is down.

Link-Local Addresses: fe80::/10

Range: fe80:: – febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff

Every IPv6-enabled interface automatically generates a link-local address starting with fe80::. These addresses are used for communication on the local network segment only and are never forwarded by routers. They are essential for IPv6 neighbor discovery, router solicitation, and the foundational protocols that allow IPv6 to function. Link-local addresses are the IPv6 analog of 169.254.x.x in IPv4, but unlike APIPA, they are a normal and expected part of IPv6 operation, not an error condition.

How to Identify If an IP Is Private

Determining whether an IP address is private or public is a fundamental networking skill. Here is a quick-reference checklist:

1. Does it start with 10.? → Private (10.0.0.0/8)
2. Does it start with 172. and is the second octet between 16 and 31? → Private (172.16.0.0/12)
3. Does it start with 192.168.? → Private (192.168.0.0/16)
4. Does it start with 100.64. through 100.127.? → CGNAT (100.64.0.0/10)
5. Does it start with 127.? → Loopback (127.0.0.0/8)
6. Does it start with 169.254.? → Link-local / APIPA (169.254.0.0/16)
7. None of the above? → Public (routable on the internet)

Be particularly careful with the 172.16.0.0/12 range. It is a common mistake to assume that all addresses starting with 172 are private. Only 172.16.x.x through 172.31.x.x are private; addresses like 172.1.0.1 or 172.32.0.1 are public. Use our Subnet Calculator if you need to verify a specific address against the CIDR range.

Common Home Network Ranges

Most home routers come configured with one of a few standard subnet configurations:

• 192.168.0.0/24 — Gateway: 192.168.0.1, DHCP range: 192.168.0.2 – 192.168.0.254. Used by many Netgear, D-Link, and TP-Link routers.
• 192.168.1.0/24 — Gateway: 192.168.1.1, DHCP range: 192.168.1.2 – 192.168.1.254. Used by Linksys, Asus, and many ISP-provided routers.
• 192.168.2.0/24 — Gateway: 192.168.2.1, DHCP range: 192.168.2.2 – 192.168.2.254. Some Belkin and SMC routers.
• 10.0.0.0/24 — Gateway: 10.0.0.1, DHCP range: 10.0.0.2 – 10.0.0.254. Common on Xfinity/Comcast and AT&T gateways.
• 10.0.1.0/24 — Gateway: 10.0.1.1. Used by some Apple AirPort routers and certain ISP devices.

Each /24 subnet provides 254 usable host addresses, which is far more than most households need. The router reserves one address as the gateway and usually starts DHCP assignments somewhere in the middle of the range (e.g., starting at .100) to leave room for statically-assigned devices like printers, servers, and smart home hubs.

Subnetting Within Private Ranges

One of the strengths of private IP addressing is the flexibility to subnet these ranges however you need. Subnetting divides a large address block into smaller, manageable segments, which improves security, reduces broadcast traffic, and simplifies network management.

For example, a small business using the 192.168.0.0/16 range might create these subnets:

• 192.168.1.0/24 — Office workstations (254 hosts)
• 192.168.2.0/24 — Guest Wi-Fi (254 hosts)
• 192.168.3.0/24 — IP phones and VoIP (254 hosts)
• 192.168.10.0/24 — Servers and infrastructure (254 hosts)
• 192.168.100.0/24 — IoT and smart devices (254 hosts)

By placing different device categories on separate subnets, you can apply firewall rules between them. For instance, you might allow office workstations to reach the server subnet but block guest Wi-Fi devices from accessing anything except the internet. This network segmentation is a foundational security practice.

For larger organizations using the 10.0.0.0/8 range, the subnetting possibilities are enormous. A common scheme is to use the second octet for location (10.1.x.x for headquarters, 10.2.x.x for the branch office), the third octet for VLAN or department, and the fourth octet for host addresses. This hierarchical approach makes routing tables predictable and troubleshooting straightforward.

Use our Subnet Calculator to plan your subnets, calculate network and broadcast addresses, determine host ranges, and convert between CIDR notation and subnet masks. For a deeper explanation of how subnetting works, read our What Is a Subnet Mask guide.

Frequently Asked Questions

What are private IP addresses?

Private IP addresses are reserved ranges defined by RFC 1918 that are used only within local networks. They are not routable on the public internet, meaning routers on the internet will not forward packets with private source or destination addresses. The three private ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.

What are the three RFC 1918 private IP ranges?

The three ranges are: 10.0.0.0/8 (10.0.0.0 – 10.255.255.255, approximately 16.7 million addresses), 172.16.0.0/12 (172.16.0.0 – 172.31.255.255, approximately 1.05 million addresses), and 192.168.0.0/16 (192.168.0.0 – 192.168.255.255, approximately 65,536 addresses).

What is the difference between private and public IP addresses?

Public IP addresses are globally unique, routable on the internet, and assigned by ISPs. Private IP addresses are used only within local networks, can be reused by any organization, and require NAT to communicate with the internet. Your router translates between the two so multiple local devices can share a single public IP.

What is CGNAT and how does it differ from RFC 1918?

CGNAT (Carrier-Grade NAT) uses the 100.64.0.0/10 range defined by RFC 6598. While RFC 1918 addresses are used within your home or office LAN, CGNAT addresses are used by ISPs to share public IPs among multiple subscribers. With CGNAT, your traffic goes through two layers of NAT — once at your router and again at the ISP — which can cause issues with port forwarding and peer-to-peer applications.

What is a link-local address (APIPA)?

Link-local addresses in the 169.254.0.0/16 range are automatically assigned when a device cannot obtain an address from a DHCP server. On Windows this is called APIPA (Automatic Private IP Addressing). These addresses only allow communication on the same physical network segment and cannot be routed. Seeing a 169.254.x.x address usually indicates a DHCP or connectivity problem.

How do I tell if an IP address is private or public?

Check if the address falls within 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 — those are private. Also check for loopback (127.0.0.0/8), link-local (169.254.0.0/16), and CGNAT (100.64.0.0/10). Any address outside these reserved ranges is a public IP address. Be careful with the 172 range — only 172.16.x.x through 172.31.x.x are private.

What are the IPv6 equivalents of private IP addresses?

In IPv6, Unique Local Addresses (ULAs) in the fc00::/7 range (practically fd00::/8) serve a similar purpose to RFC 1918 addresses — they are used within private networks and are not routed on the public internet. Link-local addresses (fe80::/10) are automatically assigned to every IPv6 interface for local-segment communication.

Can two different networks use the same private IP addresses?

Yes. Every home, office, or organization can independently use identical private IP ranges without conflict, because private addresses are never routed on the public internet. NAT ensures each network's traffic is translated to a unique public IP. However, overlapping ranges can cause routing problems when connecting two private networks via a VPN tunnel.