Public vs private IP addresses: ranges, NAT, and how to tell which is which

Your laptop has an IP address like 192.168.1.24, yet a website you visit sees something completely different, say 203.0.113.87. Both are real, both are yours in a sense, and the gap between them is one of the most useful things to understand about how home and office networks actually work.

The two kinds of address

A public IP address is globally unique and routable on the internet. Exactly one device (or one network edge) in the world holds it at a time, allocated down a chain from IANA to regional registries to your ISP. Anyone on the internet can, in principle, send a packet to it.

A private IP address is only meaningful inside a local network. Routers on the internet are required to drop packets addressed to private ranges, so the same address can be reused in millions of homes simultaneously. Your 192.168.1.24 and your neighbor's 192.168.1.24 never conflict because neither exists outside its own network.

The private ranges to memorize

RFC 1918 reserves three blocks for private use:

Two related special ranges are worth knowing so you can recognize them on sight. 127.0.0.1 (anything in 127.0.0.0/8) is loopback, meaning this machine itself. 169.254.x.x is link local: a device assigns itself one of these when it asked for an address via DHCP and nobody answered, so seeing it usually means "my network is broken," not "I have an address."

Everything outside the reserved ranges is public space. If you are unsure how the CIDR notation above works, CIDR notation and subnetting explained breaks it down, and the Subnet Calculator does the math for any range.

NAT: how private devices reach the internet anyway

If private addresses cannot exist on the internet, how does your laptop load websites? Your router performs Network Address Translation. When your laptop (192.168.1.24) sends a request, the router rewrites the source to its own public address, invents a port mapping, and remembers it. When the reply arrives at the public address, the router looks up the mapping and forwards the packet back to your laptop.

Consequences that follow directly from this:

• Every device in your home shares one public IP. Websites see the router's address, which is why a whole household looks like a single visitor to naive analytics.
• Inbound connections fail by default. An outsider can reach your public IP, but the router has no mapping telling it which internal device should receive an unsolicited packet, so it drops it. This accidental firewall is why hosting a game server or a self-hosted app requires port forwarding: you create the mapping manually.
• Your public IP is usually not yours forever. Most ISPs assign it dynamically, so it can change after a modem reboot. Carrier grade NAT goes further and shares one public address across many customers, in which case even port forwarding will not help.

IPv6 was designed to make all of this unnecessary by giving every device a globally unique address; the IPv4 vs IPv6 comparison covers how that changes the picture.

How to find each address

Private address: ask your operating system.

# macOS / Linux
ip addr        # or: ifconfig
# Windows
ipconfig

Look for the address on your active interface, typically starting with 192.168. or 10..

Public address: your own machine does not know it, because NAT happens at the router. You have to ask something on the internet what address your traffic arrives from. The IP Lookup tool shows your current public IP along with its geolocation, ISP, and network details, and lets you look up any other address the same way.

Which one matters for what

• Setting up a printer, NAS, or local dev server: the private address is what other devices on your network connect to.
• Whitelisting yourself on a firewall, or debugging "why does this site think I am in another city": the public address is what remote services see.
• Something on your network reaching out that you do not recognize: look up the public address it talks to, and check its reputation. If your own public IP is behaving badly (mail bouncing, captchas everywhere), why is my IP blacklisted covers the usual causes and fixes.