Private IP Address Ranges Explained

Why Private Addresses Exist

When the internet was designed in the 1980s, nobody expected billions of devices to need addresses. By the early 1990s, it was clear that 4.3 billion IPv4 addresses would not be enough. RFC 1918, published in 1996, designated three address ranges as “private” -- usable within local networks but never routed on the public internet.

This simple decision, combined with Network Address Translation (NAT), extended the life of IPv4 by decades. Today, almost every home router, corporate network, and cloud VPC uses private addresses internally while sharing a smaller pool of public addresses for internet access.

RFC 1918: The Three Private Ranges

These are the three private IPv4 address ranges defined by RFC 1918. They are guaranteed to never be assigned as public addresses, so they can be used freely within any private network without coordination.

10.0.0.0/8 -- The Big One

With over 16 million addresses, the 10.x.x.x range is the go-to choice for large networks. AWS VPCs default to 10.0.0.0/16 subnets. Kubernetes pod networks typically use 10.244.0.0/16 or 10.96.0.0/12. Corporate networks with thousands of devices and dozens of subnets almost always operate within the 10.x range because it offers the most room for subnetting.

172.16.0.0/12 -- The Middle Ground

This range is often chosen when 192.168.x.x is too small but there is no need for the full 10.x space. Docker uses 172.17.0.0/16 for its default bridge network. A common mistake is thinking this range covers all of 172.x.x.x -- it only covers 172.16.x.x through 172.31.x.x. Addresses like 172.32.0.1 are public.

192.168.0.0/16 -- Home and Small Office

Nearly every home router uses 192.168.0.x or 192.168.1.x by default. Most people encounter this range before any other. With 65,536 addresses it is sufficient for home networks, but large organizations need one of the bigger ranges.

Other Reserved Ranges

Beyond RFC 1918, several other IPv4 ranges are reserved for special purposes:

Loopback: 127.0.0.0/8

The entire 127.x.x.x range is reserved for loopback -- traffic sent to any address in this range loops back to the same machine. In practice, only 127.0.0.1 (localhost) is commonly used, but any address from 127.0.0.1 to 127.255.255.254 works. This is useful for running multiple local services on different loopback addresses during development.

Link-Local: 169.254.0.0/16

When a device cannot obtain an IP address from DHCP, it auto-assigns an address in the 169.254.x.x range (APIPA -- Automatic Private IP Addressing). These addresses are only valid on the local network link and are never routed. If you see a device with a 169.254 address, it usually means DHCP is misconfigured or unavailable.

CGNAT: 100.64.0.0/10 (RFC 6598)

Carrier-Grade NAT (CGNAT) uses this shared address space between ISPs and their customers. It was introduced in 2012 because even RFC 1918 addresses could conflict when ISPs needed to do multi-layered NAT. If you see a 100.64.x.x - 100.127.x.x address as your gateway, your ISP is using CGNAT. Tailscale also uses this range for its mesh VPN addresses.

Documentation: TEST-NET Ranges

Three ranges are reserved exclusively for use in documentation and examples:

• 192.0.2.0/24 (TEST-NET-1, RFC 5737)
• 198.51.100.0/24 (TEST-NET-2, RFC 5737)
• 203.0.113.0/24 (TEST-NET-3, RFC 5737)

When writing documentation or tutorials that need example IP addresses, use these ranges instead of real public addresses. They are guaranteed to never be assigned to anyone.

Multicast: 224.0.0.0/4

Addresses from 224.0.0.0 to 239.255.255.255 are reserved for multicast traffic -- one-to-many communication. Well-known multicast addresses include 224.0.0.1 (all hosts on the local network) and 239.0.0.0/8 (administratively scoped multicast).

IPv6 Private and Reserved Ranges

IPv6 has its own set of special-purpose address ranges:

• Unique Local (fc00::/7, typically fd00::/8): The IPv6 equivalent of RFC 1918. Used for private networks, not routed on the internet. The recommended practice is to generate a random 40-bit prefix within fd00::/8 for your network.
• Link-Local (fe80::/10): Auto-configured on every IPv6 interface. Always present, used for neighbor discovery. Unlike IPv4 link-local (which indicates DHCP failure), IPv6 link-local is normal and expected.
• Loopback (::1/128): A single address, not an entire block. The IPv6 equivalent of 127.0.0.1.
• Documentation (2001:db8::/32): The IPv6 equivalent of TEST-NET ranges. Use this prefix in all examples and documentation.

Practical Classification

When working with IP addresses in code, you often need to determine whether an address is public (routable on the internet) or private/reserved (local-only). Use our IP Address Lookup tool to instantly classify any address. The Classification tab shows the exact RFC, range, and description for both IPv4 and IPv6 addresses.