IPv4 Private/Public Detector

The IPv4 Private/Public Detector classifies any IPv4 address as private (RFC 1918), public (globally routable), or a special-purpose reserved range. Enter an address like 10.0.5.23 or 203.0.113.50 to instantly see its IANA-designated category, the specific RFC that defines it, and whether it should appear on the public internet.

Understanding Private and Public IP Addresses

Every IPv4 address belongs to one of two broad categories: it is either publicly routable on the internet, or it is reserved for a specific purpose that prevents it from being used on the global routing table. This distinction is fundamental to how modern networks work. Your laptop at home has a private address like 192.168.1.5 that only exists within your local network, while the web server you connect to has a public address like 93.184.216.34 that is reachable from anywhere on the internet. A NAT gateway translates between the two worlds.

The reason private address ranges exist is simple: there are not enough IPv4 addresses for every device on earth to have a unique public address. RFC 1918, published in 1996, reserved three address blocks -- 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 -- for use inside private networks. These addresses can be reused by any organization without coordination, because routers on the public internet are configured to drop packets with these source or destination addresses. This means millions of home networks can all use 192.168.1.0/24 without conflict.

Knowing whether an address is private or public matters for security, troubleshooting, and infrastructure planning. A firewall that accidentally allows traffic from a private source range to reach the internet edge is misconfigured. A DNS record that resolves to a private address when accessed from the outside reveals internal topology. A CGNAT address (100.64.0.0/10) in your logs means your ISP is doing network address translation upstream of your connection. This detector tells you exactly what category any address belongs to, so you can make informed decisions about how it should be treated.

How to Check if an IPv4 Address Is Private or Public

1. Enter any IPv4 address (e.g., 10.0.5.23 or 203.0.113.50)
2. The tool instantly classifies the address into its IANA-designated category
3. View the classification result: private, public, loopback, link-local, multicast, or other special-purpose range
4. See the specific RFC or standard that defines the address range

IPv4 Address Classification Examples

Why Use the IPv4 Private/Public Detector

• Firewall rule auditing -- verify that private addresses are not being allowed through edge firewalls where only public addresses should pass
• NAT configuration validation -- confirm that source addresses behind NAT gateways fall within RFC 1918 private ranges
• Security log analysis -- identify whether IP addresses in security alerts are internal (private) or external (public) threats
• Preventing address leakage -- detect private addresses appearing in public DNS records, HTTP headers, or API responses where they expose internal topology
• Cloud infrastructure review -- verify that VPC and virtual network subnets use appropriate private ranges
• CGNAT identification -- detect 100.64.0.0/10 addresses that indicate carrier-grade NAT, which can affect peer-to-peer connectivity and geolocation

How IPv4 Private and Public Address Ranges Work

The Internet Assigned Numbers Authority (IANA) reserves specific IPv4 ranges for designated purposes. All other addresses are considered globally routable (public) and can be assigned to internet-facing services.

RFC 1918 Private Address Ranges

Three address blocks are reserved for private internets and must never appear on the public internet:

Other Special-Purpose Ranges

Beyond RFC 1918, IANA maintains the Special-Purpose Address Registry with additional reserved blocks:

• 127.0.0.0/8 -- Loopback addresses for local-only traffic; 127.0.0.1 is the standard loopback
• 169.254.0.0/16 -- Link-local addresses auto-assigned when DHCP is unavailable (APIPA)
• 100.64.0.0/10 -- Shared address space for carrier-grade NAT (CGNAT) between ISP and customer equipment
• 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 -- Documentation ranges (TEST-NET-1, -2, -3) for use in examples and documentation
• 224.0.0.0/4 -- Multicast addresses for group communication
• 240.0.0.0/4 -- Reserved for future use (historically "Class E")

The 172.16.0.0/12 Boundary

A common mistake is assuming the entire 172.x.x.x range is private. Only 172.16.0.0 through 172.31.255.255 is private. An address like 172.32.0.1 is public. The binary representation makes this clear: the private range covers addresses where the second octet's four high bits are 0001 (16-31).

Practical Advice for Address Classification

The most consequential error involving private and public addresses is information leakage. When a private address appears in a publicly accessible context -- an API response, a DNS record, an HTTP header, an error page -- it tells an attacker something about your internal network structure. The X-Forwarded-For header is a common offender: if your reverse proxy inserts private addresses into this header before passing requests upstream, those addresses may end up in logs, analytics platforms, or third-party services where they reveal your internal topology. Always audit what your edge infrastructure exposes.

Another area where classification matters is cloud networking. AWS, Azure, and GCP all use RFC 1918 ranges for their virtual private clouds, but the specific ranges vary by provider and configuration. When you peer VPCs or connect to on-premises infrastructure via VPN, overlapping private ranges cause routing conflicts. Knowing exactly which addresses are private and which sub-ranges you have already assigned helps you avoid collisions. The 172.16.0.0/12 range is particularly error-prone because its boundaries are not intuitive in decimal -- many engineers forget that 172.32.0.1 is public.

CGNAT addresses (100.64.0.0/10) deserve special attention because they behave like private addresses from your perspective but are managed by your ISP. If you see 100.64.x.x addresses in your logs, it means your ISP is using carrier-grade NAT between their infrastructure and your connection. This can affect services that depend on knowing the client's real public IP, geolocation accuracy, and peer-to-peer protocols. Unlike RFC 1918 addresses, CGNAT addresses should not be used within your own network -- they are reserved exclusively for the ISP-to-customer link.

Frequently Asked Questions

Is 172.32.0.1 a private address?

No. The RFC 1918 private range in the 172 block is 172.16.0.0/12, covering 172.16.0.0 through 172.31.255.255 only. The address 172.32.0.1 is publicly routable. This is a common source of misconfiguration.

What is the difference between private addresses and CGNAT addresses?

Private addresses (RFC 1918) are for use within an organization's own networks. CGNAT addresses (100.64.0.0/10, RFC 6598) are specifically for the shared address space between an ISP's NAT device and customer equipment. Both are non-routable on the public internet, but CGNAT addresses should only be used by service providers.

Can private IP addresses appear in DNS or HTTP headers?

They should not appear in public-facing systems. Private addresses in DNS records, X-Forwarded-For headers, or API responses leak internal network topology, which is a security concern. This detector helps identify such addresses so you can remediate the exposure.

What happens if I accidentally route private addresses on the internet?

Internet backbone routers are configured to drop packets with RFC 1918 source or destination addresses (this is called "bogon filtering"). Your traffic will be silently discarded. However, the attempt itself may indicate a misconfigured NAT, a missing default route, or a firewall rule that failed to translate addresses before sending traffic upstream.

Which private range should I use for my network?

For most organizations, 10.0.0.0/8 provides the most space for hierarchical subnet planning -- over 16 million addresses. Use it for enterprise or multi-site deployments. The 192.168.0.0/16 range is common for home and small-office networks. The 172.16.0.0/12 range is popular for container networking (Docker uses 172.17.0.0/16 by default) and secondary address spaces.

How do documentation ranges differ from private ranges?

Documentation ranges (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24) are reserved exclusively for use in examples, documentation, and educational materials. Unlike private ranges, they are not intended for use in production networks at all -- they exist so that technical writers can include IP addresses in manuals and tutorials without risk of referencing real infrastructure.

Related Tools

• IPv6 Unique Local/Link-Local Detector - Detect IPv6 address scope and type
• IPv4 Validator - Validate IPv4 addresses in strict dotted-quad format
• Address Family Detector - Detect if an address is IPv4, IPv6, or invalid
• Extract IPs from Text - Extract IP addresses from logs or text snippets
• IPv4 ↔ Binary Converter - Convert IPv4 addresses to/from binary notation
• IPv4 Subnet Calculator - Calculate subnet details from any IPv4 CIDR block