Public vs private IP addresses

Every device on a network has an IP address, but not every address means the same thing. Some are unique across the entire internet. Others are reused, deliberately and endlessly, inside private networks that never expose them. Confusing the two is behind a surprising share of networking questions.

Public addresses are globally unique

A public address is allocated, through the regional internet registries, to exactly one organisation at a time. That uniqueness is what makes routing possible: when a packet leaves your network addressed to 93.184.216.34, every router between here and there agrees on which single destination that means.

Because the allocation is a matter of public record, a public address can be looked up. You can find the operator, the autonomous system, and an estimate of the region it serves — which is what an IP address lookup reports.

Private addresses are reused everywhere

RFC 1918 reserves three ranges that are guaranteed never to be routed on the public internet:

Your router almost certainly hands out addresses from the third range. So does your neighbour's, and your employer's, and the coffee shop's. All of them are using 192.168.1.x at the same moment, and none of them conflict, because those packets never leave the building.

This is why a lookup tool refuses them. There is no single machine behind a private address to describe. A tool that answered anyway would be guessing, so IPGet declines instead — the same reasoning that makes it report Unavailable rather than approximate a value it does not have.

NAT is what joins the two

Network address translation lets a whole private network share one public address. When a device at 192.168.1.42 opens a connection, the router rewrites the source address to its own public one, remembers the mapping, and reverses it when the reply arrives.

Two consequences follow, and both explain common surprises:

• Every device on your network looks identical from outside. A site cannot tell your laptop from your phone by address alone.
• Inbound connections have nowhere to go by default. A packet arriving at your public address with no matching mapping is dropped, because the router has no way to know which internal device it was meant for. This is exactly why a port check reports a closed or filtered port until you configure port forwarding.

The ranges that are neither

A few other ranges are also non-public, and they turn up often enough to be worth recognising:

• 127.0.0.0/8 — loopback. 127.0.0.1 is always "this machine", whichever machine is asking.
• 169.254.0.0/16 — link-local, self-assigned when DHCP fails. Seeing one usually means a device could not reach the router. 169.254.169.254 is also the cloud metadata address, which is why network tools treat the whole range as off limits.
• 100.64.0.0/10 — carrier-grade NAT. Your provider shares one public address among many customers. If you are in this range, inbound connections cannot reach you at all and no amount of port forwarding will change that.

IPv6 draws the line differently

IPv6 has enough addresses that NAT was never necessary, so devices commonly hold a globally routable address directly. The equivalent of a private range is fc00::/7 — unique local addresses — but it is far less common in practice than RFC 1918 is in IPv4. The practical upshot: an IPv6 address you see on a device is more likely to be publicly routable than an IPv4 one, which occasionally surprises people who assume a firewall is doing what NAT used to do by accident.

Working out which is which

The quickest check is the first octet. 10., 127., 169.254. and 192.168. are never public, and 172. is private only between 172.16 and 172.31. For anything less obvious — or to see where a subnet's boundaries actually fall — a subnet calculator answers it exactly, including which addresses in a block are usable.

If you have a public address and want to know what it is attached to, a reverse DNS lookup gives the host name its owner published, and an IP lookup gives the operator and approximate region.