Public vs Private IP Address: The Simple Difference

The internet routes packets by destination address, which only works if every address on the public internet is unique. Public addresses are globally unique and routable: every router on the internet knows how to forward a packet toward them. Private addresses come from ranges that RFC 1918 set aside for use inside networks; routers on the public internet drop packets addressed to them, and the same private address is in use in millions of homes at once without conflict, because it never has to be unique beyond the network it belongs to.

Private IP addresses are used inside local networks. Common ranges include 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.

These addresses are not directly reachable from the public internet and are often reused in homes, offices, and internal systems. That reuse is the point: your laptop, printer and television can be 192.168.1.10, .11 and .12, and so can the same devices in every other home on the street.

A public IP address is routable on the internet. It is the address websites see when your router, server, VPN, or mobile network sends traffic.

Public addresses are allocated by the Regional Internet Registries to ISPs and organizations, which assign them to customers. A home connection normally gets a dynamic address the ISP can change; servers and business lines can pay for a static one. If multiple devices use the same router, they share one public IP while keeping separate private addresses inside the network.

Your router bridges the two worlds with Network Address Translation, described in RFC 3022. When a device sends a packet to the internet, the router swaps the private source address and port for its own public address and a port it chooses, and records the mapping; when the reply arrives at that public address and port, it forwards the packet to the right device. Every outbound connection gets its own entry, so dozens of devices share one address without confusion.

Two consequences follow. Websites see the whole household as one address, which is why lookups from your phone and your laptop on the same Wi-Fi agree. And an unsolicited inbound connection has no mapping to follow, so it is dropped unless you create one by hand, which is what port forwarding does.

Many ISPs, and most mobile carriers, add a second layer of NAT inside their own network so that many customers share one public IPv4 address. For the link between their equipment and yours they use 100.64.0.0/10, the shared address space RFC 6598 reserved for exactly this purpose. It is neither private in the RFC 1918 sense nor public: not routable on the internet, and not meant to appear inside your home network either. A router WAN address between 100.64.0.0 and 100.127.255.255 means you are behind carrier-grade NAT; the CGNAT guide explains what that changes.

The private address is the one your operating system reports: ipconfig on Windows, ifconfig or ip addr on macOS and Linux, the Wi-Fi network's details on a phone. Your router's admin page lists both sides, the LAN address it uses inside your network and the WAN address it received from the ISP.

The public address is the one a website receives, so the reliable way to see it is an IP lookup, which shows the address the request arrived from with the ISP and approximate location. Compare it with the router's WAN address: a match means your router holds the public address itself; a WAN address in 100.64.0.0/10 or in a private range means another layer of NAT sits above you. The guide to checking your own IP address covers the command-line methods.

By the time a packet leaves your network, NAT has replaced the private address with the public one. The website's server receives only the public address; the private one never crosses the router, and the site has no way to ask for it. Looking up 192.168.1.1 on a geolocation service therefore returns nothing meaningful: the address exists in almost every home and office on Earth, so it has no ISP, no city and no reputation of its own.

IP geolocation tools are most useful for public IP addresses. Private addresses generally do not map to a public city, ISP, or risk profile. Use Crafzo IP Lookup to check the public IP visible to websites or analyze another public address.

IPv6 keeps the same split under different names. Global unicast addresses, defined in RFC 4291 and currently allocated from 2000::/3, are the public addresses; the address space is so large that each device normally gets its own instead of sharing through NAT. Unique local addresses, defined in RFC 4193, are the private equivalent: they live in fc00::/7 (in practice fd00::/8), carry a random 40-bit identifier so that two networks rarely collide when they are later joined, and are not routed on the internet.

NAT is not part of the normal IPv6 design; the protection people associate with it comes from the firewall, and privacy comes from temporary addresses that rotate on a schedule, covered in the IPv4 versus IPv6 guide. For the complete list of reserved and special-purpose ranges in both protocols, see private, reserved and special IP addresses.