Private and Reserved IP Ranges
The address blocks that never appear on the public internet, and the ones that look public but are not.
The short version
Three IPv4 blocks are reserved for private networks, one is reserved for carrier-grade NAT, and a handful of small blocks are set aside for loopback, link-local traffic, documentation and multicast. None of them can be reached from the public internet, which is exactly what makes them useful.
| Block | Addresses | RFC | Where you meet it |
|---|---|---|---|
| 10.0.0.0/8 | 16,777,216 | 1918 | Office networks, VPNs, cloud VPCs |
| 172.16.0.0/12 | 1,048,576 | 1918 | Docker's default bridge is 172.17.0.0/16, inside this block |
| 192.168.0.0/16 | 65,536 | 1918 | Home routers, the familiar 192.168.1.x |
| 100.64.0.0/10 | 4,194,304 | 6598 | Carrier-grade NAT between an ISP and its subscribers |
| 127.0.0.0/8 | 16,777,216 | 1122 | Loopback; 127.0.0.1 is localhost |
| 169.254.0.0/16 | 65,536 | 3927 | Self-assigned when DHCP fails |
| 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 | 768 | 5737 | Documentation examples; never routed |
| 224.0.0.0/4 | 268,435,456 | 5771 | Multicast groups |
| 240.0.0.0/4 | 268,435,456 | 1112 | Reserved for future use |
Why RFC 1918 exists
IPv4 has about 4.3 billion addresses, and they ran out at the registry level in the 2010s. RFC 1918 postponed that by letting every organisation reuse the same three blocks behind a router that translates private addresses to a public one. A packet with a private source or destination is dropped by internet routers, so the same 192.168.1.10 can exist in millions of homes without conflict.
The trade is that a private address identifies a device only inside its own network. A web server cannot tell two visitors apart by their private addresses, because it never sees them: it sees the router's public address.
The three private blocks are not interchangeable
They differ only in size, and size drives habit:
- 10.0.0.0/8 is one huge block. A single /8 gives 16.7 million addresses, enough for a large enterprise or a cloud provider to carve into subnets. It is also the range most likely to collide when two companies merge and both used 10.0.0.0/8 internally.
- 172.16.0.0/12 covers 172.16.0.0 through 172.31.255.255, not the whole 172 range. 172.32.0.1 is public. This is a common source of confusion, and the reason a Docker bridge on 172.17.0.1 is private while 172.32.0.1 is not.
- 192.168.0.0/16 is the smallest and the most familiar. Home routers ship with 192.168.1.1 or 192.168.0.1, and the block is large enough for a household but small enough to be memorised.
Carrier-grade NAT is not RFC 1918
100.64.0.0/10 was reserved in 2012 for the NAT layers that ISPs deploy when they cannot hand every subscriber a public IPv4 address. It behaves like private space but is not one of the three RFC 1918 blocks. The distinction matters in logs: a 100.64.x.x source address means the request passed through the ISP's NAT, so the address cannot be used to identify a subscriber, and geo-looking it up returns the ISP, not the user.
Loopback and link-local
127.0.0.0/8 is the loopback block. Traffic to any address in it never leaves the machine. 127.0.0.1 is the conventional name; 127.0.0.53 is used by some local DNS resolvers. A service bound only to 127.0.0.1 is unreachable from another host, which is a security feature, not a bug.
169.254.0.0/16 is link-local. When a device cannot get an address from DHCP, it picks one from this block and announces it on the local link. The address is valid only on that link. Seeing 169.254.x.x on a machine is a diagnostic signal: the DHCP request did not get an answer.
Documentation blocks
192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24 exist so that examples, screenshots and tests can use addresses that look real without pointing at anyone's server. They are never routed. The same idea in IPv6 is 2001:db8::/32. If a tutorial uses a public-looking address that belongs to a real company, it is a bad tutorial.
IPv6 private space
IPv6 has no RFC 1918 equivalent with the same history, but it has two ranges that stay local:
- fc00::/7 is unique local addressing, defined in RFC 4193. The fd00::/8 half is the one you are meant to generate randomly; the fc00::/8 half is reserved. It is the closest thing to private space, and it is not routable on the public internet.
- fe80::/10 is link-local. Every IPv6 interface configures one automatically, and routers do not forward it. Neighbour discovery runs on it.
A third range, ::ffff:0:0/96, is not private at all: it is an IPv4 address written in IPv6 notation. It is worth recognising so it is not mistaken for a native IPv6 address.
Checking a range in practice
The lookup page shows the public address your connection presents. If that address falls in one of the private or reserved blocks above, the page says so and skips the location lookup, because there is no public location to find. For a quick manual check, remember that a private address is one that starts with 10., with 172.16 through 172.31, or with 192.168; a link-local address starts with 169.254; and a loopback address starts with 127.
One caution. A private address in a log does not tell you which device it was. The same 192.168.1.10 appears in millions of networks. Correlating it with a person requires the router's NAT table, which the website does not have and should not ask for.