CCNA online course

Private IP Addresses in IPv4 Networking

Learn RFC 1918 private IPv4 ranges, subnetting, NAT/PAT, routing behavior, address planning, VLAN design, and troubleshooting.

Private IPv4 addresses are used inside homes, organizations, laboratories, branch offices, and other networks that are not directly addressed on the public Internet. This lesson explains the RFC 1918 ranges, subnetting, NAT, address planning, common network designs, special-use ranges, and troubleshooting.

What Is a Private IPv4 Address?

A private IPv4 address is an address from one of the ranges defined for internal use by RFC 1918. Organizations can assign these addresses to hosts, interfaces, servers, phones, wireless clients, printers, and other devices inside their networks.

A public IPv4 address is globally unique and can be advertised and routed on the public Internet when an Internet service provider and network policy permit it. A private address is not globally unique and should not be routed across the public Internet.

Because private addresses are not globally unique, different organizations may reuse the same range independently. For example, a home network, a school, and a company may all use 192.168.1.0/24 internally. This reuse conserves scarce public IPv4 space, but it creates an address overlap problem when those networks must communicate through a VPN, merger, cloud connection, or shared WAN.

RFC 1918 Private IPv4 Ranges

RFC 1918 defines three private IPv4 blocks. The CIDR prefix states how many leading bits identify the block. The traditional classful mask is shown for historical recognition and basic comparison; modern networks use CIDR and subnetting rather than relying on address classes.

For each complete block, the first address identifies the overall block and the last address is its directed-broadcast boundary when the entire block is treated as one subnet:

• 10.0.0.0 is the first address and 10.255.255.255 is the last address in 10.0.0.0/8.
• 172.16.0.0 is the first address and 172.31.255.255 is the last address in 172.16.0.0/12.
• 192.168.0.0 is the first address and 192.168.255.255 is the last address in 192.168.0.0/16.

In normal designs, these large blocks are divided into smaller subnets. Therefore, the network and broadcast boundaries that matter to a host are usually the boundaries of its assigned subnet, not the boundaries of the original RFC 1918 block.

Private Ranges and Subnetting

Subnetting divides a larger network prefix into smaller networks. A subnet mask identifies which bits belong to the network portion and which bits remain for hosts. A longer prefix leaves fewer host bits and creates a smaller subnet.

For a conventional IPv4 subnet, the network address is the first address and identifies the subnet. The directed broadcast address is the final address and represents all hosts in that subnet. These addresses are not assigned to ordinary hosts.

Example: Four Subnets from 192.168.50.0/24

Borrowing two host bits changes /24 to /26. Each /26 has 64 total addresses, including one network address and one broadcast address, leaving 62 normal host candidates.

A private address is not automatically a valid host address. For example, 192.168.50.0 is private, but it is the network address of the first /26 and should not be assigned to a normal host. Likewise, 192.168.50.63 is private but is the directed broadcast address for that subnet.

Private Addresses and Internet Routing

Internet service providers and public Internet routers should not advertise or route RFC 1918 prefixes across the public Internet. If a packet with a private source address leaves an organization without translation, Internet destinations cannot reliably return traffic because that source address may exist in thousands of unrelated networks.

Private addresses can still be routed over infrastructure controlled by an organization or service provider. For example, private prefixes may be carried through a private WAN, VPN, MPLS service, or SD-WAN overlay. This is different from global Internet reachability because the administrative domain controls the routes and the participating networks.

Private addressing therefore answers the question, “Is this address intended for internal use?” It does not by itself answer whether two private networks can communicate. Routing, filtering, VPN policy, and address overlap determine that.

NAT and PAT for Internet Access

Network Address Translation (NAT) changes IP address information as traffic crosses between address domains. A common home or enterprise edge router translates private source addresses into a public address before forwarding traffic to the Internet.

For an internal host, the inside local address is its private address before translation. The inside global address is the public address that represents that host after translation.

1. A workstation such as 192.168.10.25 sends traffic to its default gateway, 192.168.10.1.
2. The edge router changes the source address to its public WAN address, such as 203.0.113.10. This address is from a documentation range and is used here only as an example.
3. The router records the translation so that return traffic can be associated with the internal workstation.
4. When the reply arrives, the router reverses the translation and forwards the packet to 192.168.10.25.

Port Address Translation (PAT), also called NAT overload, allows many private hosts to share one public IPv4 address. The router distinguishes simultaneous sessions using transport-layer port numbers and maintains a translation table. A small public address pool can also be shared among many internal devices.

Illustrative Cisco IOS PAT Configuration

interface GigabitEthernet0/0
 ip address 192.168.10.1 255.255.255.0
 ip nat inside
interface GigabitEthernet0/1
 ip address 203.0.113.10 255.255.255.252
 ip nat outside
access-list 1 permit 192.168.10.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/1 overload
ip route 0.0.0.0 0.0.0.0 203.0.113.9

The WAN values above are documentation examples. A real deployment also needs valid provider addressing, upstream connectivity, and an appropriate security policy. The inside and outside NAT roles must be applied to the correct interfaces.

Selecting a Private Address Range

• 10.0.0.0/8: provides the most space and supports large, hierarchical plans. It is often divided by region, site, function, or environment and can support route summarization.
• 172.16.0.0/12: provides a middle-sized block and can be a useful compromise for organizations that need more structure than a few /24 networks but do not require the entire 10/8 block.
• 192.168.0.0/16: is convenient for small sites, homes, and labs, but many consumer routers use common prefixes such as 192.168.0.0/24 or 192.168.1.0/24.

Choose an address plan based on current host counts, expected growth, subnet sizes, site boundaries, security zones, summarization, and connectivity to external networks. Document the allocation instead of choosing prefixes arbitrarily. Reserve space for future VLANs, branches, management, infrastructure, and services.

Common home prefixes can overlap with corporate prefixes. If a user at home and a company both use 192.168.1.0/24, a VPN client may send traffic for a corporate 192.168.1.x destination to the local home interface instead of the VPN tunnel. Renumbering one side is usually the cleanest solution. If renumbering is impossible, an approved translation design may be required.

Private Addresses in Network Designs

Private addresses are common on user LANs, VLANs, wireless networks, server networks, management networks, branch offices, home networks, and training labs. A typical site separates functions into different VLANs and assigns each VLAN its own IP subnet.

Each host normally uses a default gateway in the same subnet. The gateway is usually a router interface, switched virtual interface, firewall interface, or router-on-a-stick subinterface. It forwards traffic destined for other subnets.

For example, a user VLAN might use 192.168.10.0/24 with gateway 192.168.10.1, while a server VLAN uses 192.168.20.0/24 with gateway 192.168.20.1. The two VLANs require routing to communicate; placing them in separate VLANs does not automatically provide or deny communication. ACLs and firewall policy control what the routing permits.

See Configure Trunk Ports for carrying multiple VLANs, and Configure Router On A Stick for routing between VLANs using router subinterfaces.

Private and Special-Use IPv4 Ranges Compared

Other special-use categories include 0.0.0.0 as an unspecified address, documentation ranges such as 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24, and other standards-defined purposes. Not every address that is non-public-looking is an RFC 1918 private address.

Verification Commands

On Cisco IOS or IOS XE

show ip interface brief
show interfaces
show running-config | section interface
show ip route
show ip nat translations
show ip nat statistics

Use the interface commands to check IP addresses, masks, line state, and NAT roles. Use show ip route to verify connected routes and a default route. Use the NAT commands to confirm that translations are being created and that counters increase when clients generate traffic.

On Windows, macOS, or Linux

ipconfig /all
ip addr
ip route
ping <default-gateway>
tracert <destination>
traceroute <destination>

Verify the host address, subnet mask or prefix, default gateway, DNS servers, and local routing table. Test the default gateway first, then an external IP address, and finally a DNS name. ping and traceroute can be inconclusive because firewalls and routers may filter ICMP or use different return paths.

Troubleshooting Private IPv4 Networks

169.254.0.0/16 Appears Instead of the Expected Address

An address such as 169.254.15.8 indicates link-local behavior, commonly caused by DHCP failure.

• Confirm the physical or wireless link.
• Check switch-port VLAN membership.
• Verify the DHCP scope has available addresses.
• Check DHCP relay configuration and reachability when the server is on another subnet.
• Correct the issue, then release and renew the client lease.

The Client Reaches Its Gateway but Not the Internet

• Check whether the edge router has a correct default route.
• Confirm that NAT or PAT is configured and that the inside and outside interfaces are correct.
• Verify that the NAT match rule includes the client subnet.
• Check firewall or ACL policies and upstream reachability.
• Test an external IP address separately from a DNS name. If IP connectivity works but names fail, investigate DNS.

A VPN User Reaches a Local Device Instead of the Corporate Host

Compare the local, remote, and corporate prefixes. Look at the client route table, VPN traffic selectors, and split-tunnel routes. If the networks overlap, renumber one network when possible or use an approved translation design.

Intermittent Connectivity from Duplicate Addresses

Two devices using the same private address can cause changing ARP mappings: traffic may be sent alternately to different hardware addresses.

• Compare ARP entries and the MAC addresses associated with the disputed IP.
• Review DHCP leases and excluded ranges.
• Find unmanaged devices or incorrect static assignments.
• Reserve infrastructure addresses outside dynamic pools and document all static assignments.

Exam- and Operations-Relevant Summary

• The RFC 1918 blocks are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
• 172.20.10.5 is private, but 172.32.10.5 is not in the RFC 1918 172.16.0.0/12 block.
• Private addresses may be reused, so they are not globally unique.
• Public Internet routers should not route RFC 1918 prefixes across the public Internet.
• NAT translates address domains; PAT uses ports so many private hosts can share a public address.
• NAT is not a substitute for firewall policy.
• Network and broadcast addresses are not ordinary host addresses, even when they come from a private block.
• Separate VLANs normally use separate IP subnets and require routing between them.
• 169.254.0.0/16 is link-local/APIPA, and 100.64.0.0/10 is shared CGNAT space; neither is RFC 1918 private space.