Public vs private IP addresses
Open the network settings on your laptop and you will probably see an address like 192.168.1.20. Open the WebIPTool home page and you will see a completely different one. Both are correct. The first is your private address, used inside your home. The second is your public address, the one the rest of the internet sees.
Understanding the split explains a lot of everyday network behavior: why devices at home can find each other, why outsiders cannot reach them directly, and why port forwarding exists.
Public addresses
A public address is unique across the entire internet. Your internet provider assigns one to your connection, and every packet you send out carries it as the return address. Websites, game servers, and video calls all see this address.
Because public IPv4 addresses are scarce, a typical home gets exactly one, and it is assigned to the router rather than to any single device.
Private addresses
A private address only has meaning inside one local network. Your router hands one to each device that joins, so the printer, the phones, and the laptops can all talk to each other and to the router.
Three IPv4 ranges are set aside for this in RFC 1918:
| Range | Written as a block | Addresses | Where you usually see it |
|---|---|---|---|
10.0.0.0 to 10.255.255.255 |
10.0.0.0/8 |
About 16.8 million | Offices, larger networks, some home routers |
172.16.0.0 to 172.31.255.255 |
172.16.0.0/12 |
About 1 million | Offices, virtual machines, containers |
192.168.0.0 to 192.168.255.255 |
192.168.0.0/16 |
65,536 | Most home routers |
Routers on the public internet refuse to carry traffic for these ranges. That is what makes them reusable: your 192.168.1.20 and your neighbor’s 192.168.1.20 never meet.
The Subnet Calculator tells you whether any address or block is private, and how many devices fit in it.
How one public address serves a whole home
The router sits on the boundary and holds both kinds of address: a private one facing your devices and the public one facing your provider. When a device sends something out, the router rewrites the packet so it appears to come from the public address, and it remembers which device asked. When the reply arrives, the router looks up that note and passes the reply to the right device.
This is Network Address Translation, or NAT.
The router tells conversations apart by port number. Two laptops can load the same website at the same moment because the router gives each outgoing connection its own port on the public side and keeps a table of which port belongs to which device.
Why outsiders cannot reach your devices
NAT works on demand. The router only knows where to deliver an incoming packet if a device inside asked for it first. A packet that arrives unannounced matches nothing in the table, so the router drops it.
That has two consequences:
- It protects you by default. Random scans from the internet stop at the router.
- It gets in the way of hosting. If you want to run a game server or host a small website at home, outside connections have nowhere to go.
Port forwarding is the fix. You add a permanent rule in the router that says, for example, “anything arriving on port 25565 goes to 192.168.1.50”. From then on the router has an answer for those unannounced packets.
Forward only the ports you need, and only to devices you keep updated. Each forwarded port is a door that anyone on the internet can knock on.
Three habits keep it safe:
- Reserve the device’s address first. Give it a fixed address in the router’s settings, so the rule still points at the right machine after a restart.
- Leave cameras and other smart devices out. The UK’s National Cyber Security Centre, in its advice on smart cameras, warns that criminals can use port forwarding and UPnP to reach devices like these.
- Check UPnP. It lets devices open ports on their own, without asking you. Turn it off if nothing you use needs it. Some games and media devices do.
Other reserved ranges you may run into
Not every odd-looking address is an RFC 1918 private address. A few others have special meaning:
| Range | Meaning |
|---|---|
127.0.0.0/8 |
Loopback. 127.0.0.1 always means “this device itself”. |
169.254.0.0/16 |
Link-local. A device gives itself one of these when it asked for an address and nobody answered. It usually means the router or DHCP is not reachable. Defined in RFC 3927. |
100.64.0.0/10 |
Shared address space for carrier-grade NAT. If your router’s internet-side address is in this range, your provider is sharing a public address between customers. Defined in RFC 6598. |
The full list is in the IANA IPv4 Special-Purpose Address Registry.
How to tell which one you are looking at
Check the first numbers. If the address starts with 10., 192.168., or 172.16. through 172.31., it is private.
Check where you found it. An IPv4 address shown in your device’s own network settings is almost always private. An address reported by a website is always the public one, because a website can only see what arrives over the internet.
Compare them. Look up your device’s IPv4 address in its settings, then open the home page. On a normal home connection the two will differ. If they match, your device is connected directly to the internet with no router in between, which is unusual outside of servers and some mobile setups. IPv6 is different: your device’s IPv6 address normally matches the one the home page shows, and that is expected.
One more comparison is worth making. Log in to your router and find the address on its internet or WAN page. If that IPv4 address is not the one the home page shows, there is another layer of NAT between your router and the internet. An address starting with 192.168. usually means a second router, such as your provider’s modem. One from 100.64.0.0 to 100.127.255.255 means CGNAT, covered in what is CGNAT.
What about IPv6?
IPv6 has enough addresses that sharing is unnecessary. With IPv6 each of your devices normally gets its own public address, and the router protects them with a firewall instead of relying on NAT as a side effect.
IPv6 still has a private-style range, called unique local addresses, which start with fd. They are defined in RFC 4193 and are used for traffic that should stay inside a site. You will also see addresses starting with fe80, which are link-local: every IPv6 device has one, and it only works on the local network segment.
More on the two protocols in IPv4 vs IPv6.
Common questions
Can two devices have the same private address? Not on the same network. If they do, both will have connection problems until one changes. On different networks it happens constantly and causes no harm.
Can someone find me from my private address? No. A private address like 192.168.1.20 is used by millions of networks and says nothing about you. Sharing it in a support forum is harmless.
Should I hide my public address? It is visible to every site you visit by design. What it reveals is limited, and what your IP address reveals goes through it.
Why does my work VPN change which sites I can reach? A VPN gives your device an extra private address on the company’s network, so internal systems treat you as if you were in the office.
Key points
- Private addresses work inside one network. Public addresses work across the internet.
- Your router translates between them with NAT, which is why a whole home shares one public address.
- NAT blocks unrequested incoming connections. Port forwarding makes deliberate exceptions.
- An address starting with
100.64.through100.127.on your router’s internet side means your provider uses CGNAT.