Public vs Private IP Addresses: What's the Difference?

A public IP address is the globally unique address assigned to your router by your Internet Service Provider, visible to every website and service you connect to on the internet. A private IP address is the internal address your router assigns to each device on your home or office network, invisible to the outside world. Every time you go online, both types are working together, and understanding the difference explains a lot about how your network actually functions.

The Two-Address System

Think of it like a building with an apartment complex. The building has one street address that the postal service uses for deliveries. That’s the public IP. But inside the building, each apartment has its own unit number. That’s the private IP. Mail arrives at the building address, and the mail room (your router, in this analogy) figures out which apartment to deliver it to.

Right now, your home network is doing exactly this. Your ISP assigned your router a single public IP address, something like 98.51.100.27. Your router then created its own mini-network and assigned private IPs to every device:

• Your laptop: 192.168.1.2
• Your phone: 192.168.1.3
• Your smart TV: 192.168.1.4
• That Raspberry Pi you set up once and forgot about: 192.168.1.5

When your laptop visits a website, the website only sees 98.51.100.27. It has no idea about your 192.168.1.2 address. That stays between you and your router.

Private IP Ranges (Memorize These, Seriously)

Three blocks of addresses are permanently reserved for private use. These addresses can never appear on the public internet, and every router in the world drops packets addressed to them:

If you see an IP that starts with 10., 172.16. through 172.31., or 192.168., you’re looking at a private IP. Period. No exceptions.

Your home router almost certainly uses the 192.168.x.x range. The router itself is usually 192.168.0.1 or 192.168.1.1, and it assigns addresses counting upward from there. The reason every router manufacturer uses this same range is simply convention. There’s nothing technically special about 192.168. versus 10.; the 192.168. range is just what home networking equipment defaulted to years ago and everyone followed suit.

NAT: The Magic in the Middle

So how does one public IP serve twenty devices? Through NAT (Network Address Translation). This is the technology that made the modern internet possible despite running out of IPv4 addresses.

When your laptop (private IP 192.168.1.2) sends a request to load Google, your router does this:

1. Receives the packet from 192.168.1.2 destined for Google
2. Replaces the source address (192.168.1.2) with its public IP (98.51.100.27)
3. Assigns a unique source port number (say, port 54321) and records the mapping in a table: “port 54321 = laptop at 192.168.1.2”
4. Sends the packet out to the internet from 98.51.100.27:54321
5. When Google responds to 98.51.100.27:54321, the router checks its table
6. Finds that port 54321 maps to 192.168.1.2
7. Replaces the destination address and forwards the response to the laptop

This happens for every single connection from every device on your network. Simultaneously. Your router manages a translation table with potentially thousands of active mappings at any given time. It’s doing a remarkable amount of work that nobody thinks about.

Types of NAT

Not all NAT implementations are equal:

Full Cone NAT: Once a mapping is created, any external host can send data through it. The most open and easiest for P2P connections.

Restricted Cone NAT: Only the specific external IP that was initially contacted can send data back. More secure but can cause issues with some applications.

Port Restricted Cone NAT: Like restricted cone but also requires the external port to match. Even more restrictive.

Symmetric NAT: Creates a unique mapping for each external destination. The most restrictive type and the one most likely to cause problems with VoIP, gaming, and P2P applications. Unfortunately, it’s also the most common type used by ISPs.

If you’ve ever struggled to join an online game or had problems with video calling, symmetric NAT is frequently the culprit. Technologies like STUN, TURN, and ICE (used by WebRTC) exist specifically to punch through NAT restrictions.

Why Private IPs Exist

The private IP system was created in 1996 (RFC 1918) primarily to conserve IPv4 addresses. Without it, every device on every network in the world would need its own globally unique public IP. With only 4.3 billion IPv4 addresses available, that math stopped working sometime around 2005.

But private IPs also provide a useful (though imperfect) layer of isolation. Devices with private IPs are not directly reachable from the internet. Someone can’t just type 192.168.1.5 into their browser and access your laptop. The router’s NAT acts as an implicit firewall of sorts; it only forwards incoming traffic that matches an existing mapping in its translation table.

Important caveat: NAT is not a firewall. It wasn’t designed for security, and treating it as your primary defense is a mistake. Proper firewall rules are still essential. NAT just happens to block unsolicited incoming connections as a side effect of how it works.

CGNAT: When Even NAT Isn’t Enough

As IPv4 exhaustion got worse, ISPs invented CGNAT (Carrier-Grade NAT). This is NAT on steroids. Instead of each household getting a unique public IP, the ISP puts multiple customers behind a single shared public IP using another layer of NAT.

So the chain now looks like:

Your device (192.168.1.5) → Your router (NAT) → ISP CGNAT (10.x.x.x) → Internet

Two layers of NAT. Your device’s traffic gets translated twice before it reaches the public internet.

This causes real problems:

• Port forwarding doesn’t work (you don’t control the ISP’s NAT)
• IP geolocation becomes less accurate (your IP is shared with hundreds of others)
• Gaming issues with NAT type restrictions
• IP reputation problems (if one customer behind the shared IP gets blacklisted, everyone sharing that IP is affected)
• Some services limit connections per IP, and you’re sharing with strangers

You can check if you’re behind CGNAT by comparing the WAN IP shown on your router’s admin page with your public IP at whatismyip.technology. If they don’t match, you’re behind CGNAT.

The IPv6 Solution

IPv6 largely eliminates the need for NAT and private addresses. With 340 undecillion addresses available, every device can have its own globally unique IP. No translation needed. End to end connectivity is restored.

In IPv6 networks, what used to be “private” addressing is handled differently. Link-local addresses (starting with fe80::) are generated automatically on every IPv6-enabled interface and are only valid within the local network segment. They serve a similar purpose to IPv4 private addresses but are part of the protocol design rather than a workaround.

Most IPv6-enabled networks still provide both public and link-local addresses. The link-local is for local communication (neighbor discovery, router advertisements), and the global unicast address is for internet traffic. No NAT required.

Test It Yourself

Frequently Asked Questions