Nmap online course

Private IPv4 Addresses

Learn RFC 1918 private IPv4 ranges, CIDR masks, address reuse, routing, NAT, overlap, and authorized Nmap discovery.

A private IPv4 address is an IPv4 address reserved for internal networks rather than global Internet routing. Private addressing makes it possible for homes, schools, and organizations to build networks without obtaining a globally unique address for every device.

An IPv4 address is a 32-bit network-layer address used to identify an IPv4 interface. It is commonly written as four decimal octets, such as 192.168.1.20. A CIDR prefix uses slash notation, such as /24, to indicate how many leading bits identify the network.

Why Private IPv4 Addresses Exist

IPv4 has a finite address space of approximately 4.3 billion possible 32-bit addresses. That number is much larger than the number of publicly usable addresses because some addresses are reserved for special purposes, and because addresses are needed across a rapidly expanding number of networks and devices. This created pressure on the available public IPv4 address space.

A public IPv4 address is intended to be globally unique and may be routed across the Internet when routing and security policies permit. A private IPv4 address is intended for internal use and is excluded from global public routing. The same private address can therefore be used independently by many organizations and home networks.

For example, a home network and a company network may both use 192.168.1.20. The address is meaningful inside each local network, but it does not uniquely identify one host worldwide.

RFC 1918 Private IPv4 Ranges

RFC 1918 specifies the three private IPv4 blocks. Each block can be divided into smaller subnets, which are smaller networks created by applying a longer prefix length.

The counts above include every address in each block. A particular subnet may reserve its network and broadcast addresses, depending on the addressing rules being used.

Important Boundary Details

• 10.0.0.0/8 includes every address from 10.0.0.0 to 10.255.255.255.
• 172.16.0.0/12 includes only 172.16.0.0 through 172.31.255.255. Addresses such as 172.32.5.10 are not part of this RFC 1918 allocation.
• 192.168.0.0/16 includes every address from 192.168.0.0 to 192.168.255.255.

The entire 172.0.0.0/8 range is not private. Only the 172.16.0.0/12 section is private.

Private Ranges and Subnet Masks

The prefix length tells a router how much of an address identifies the network. For example, 10.0.0.0/8 has eight network bits and a large host portion. An organization can divide it into smaller networks, such as 10.0.0.0/24, which contains addresses from 10.0.0.0 through 10.0.0.255.

Similarly, an organization may use 172.20.0.0/16 from the 172.16.0.0/12 allocation, or 192.168.50.0/24 from the 192.168.0.0/16 allocation. The larger RFC 1918 block is an allocation boundary; the organization chooses smaller subnet boundaries inside it.

Private and Public IPv4 Compared

Routing Behavior on the Internet

Routing is the forwarding of packets between networks according to routes and policies. An Internet-facing router should not advertise RFC 1918 networks as public destinations. Networks at the Internet edge should also filter packets that use private addresses as inappropriate public source or destination addresses.

An internal route and a public Internet route are different things. A company router might have a route for 10.20.0.0/16 through an internal interface or VPN. That route can deliver traffic inside the organization's network. It does not mean that the public Internet has a route to 10.20.0.0/16.

A default gateway is the router a host uses for destinations outside its local subnet. If the gateway has no valid route to a private destination, or if the destination is not reachable through an authorized LAN, private WAN, or VPN, packets will not reach it.

Address Reuse and Network Overlap

Consider two separate organizations:

• Organization A uses 10.0.0.0/24 internally.
• Organization B also uses 10.0.0.0/24 internally.

This duplication does not cause a conflict while the networks remain isolated. Each organization has its own routers, hosts, and routing context. A host at 10.0.0.25 in Organization A is different from a host at 10.0.0.25 in Organization B because the addresses are interpreted within different networks.

Address overlap occurs when connected networks use the same or intersecting IP address space. It becomes a problem when the organizations connect through a VPN, private WAN, merger, or other shared routing arrangement. If both sides claim 10.0.0.0/24, a router cannot reliably determine whether 10.0.0.25 is local or remote. Common solutions include renumbering one network or using a carefully designed translation scheme.

Another Overlap Example

A user on 192.168.1.0/24 connects by VPN to a remote site that also uses 192.168.1.0/24. The user's computer normally considers that subnet local, so it may send traffic directly to the local network instead of through the VPN. The remote hosts may therefore be unreachable until one side renumbers or the VPN design provides deliberate translation and routing.

How NAT Connects Private Networks to the Internet

NAT, or Network Address Translation, is commonly used at a network boundary. A gateway translates an internal private source address into one or more public addresses when an internal host starts an Internet connection.

For example, a home router might have this arrangement:

• LAN gateway: 192.168.1.1/24
• Client devices: 192.168.1.20 and 192.168.1.30
• Outside interface: a public IPv4 address assigned by the ISP

When 192.168.1.20 contacts an Internet server, the router changes the packet's source information for the outbound connection to its public address and records the connection state. The response can then be translated back to the internal client.

PAT or NAPT is port-based NAT. It lets multiple internal hosts share one public IPv4 address by using different transport port mappings. NAT conserves public addresses, but it does not make the private address itself publicly routable.

Unsolicited inbound access normally requires an explicit port-forwarding rule. Port forwarding is an inbound NAT rule that maps traffic arriving at a public address and port to an internal host and port. A firewall policy, service configuration, and other controls may also be required.

Recognizing Private Addresses

Inspecting Your Local Address and Routes

On Linux, use these commands to view IPv4 addresses and routes:

ip -4 addr show
ip route show

Look for the interface address, prefix length, and default route. Classify the address explicitly; not every address shown by the command is necessarily RFC 1918. The routing table shows whether a private destination is local, reachable through another internal network, or sent to the default gateway.

On Windows, use:

ipconfig
route print -4

Use the IPv4 address, subnet mask or prefix, and default gateway fields to connect the host's configuration to its local network and route selection.

Private Addresses in Nmap Discovery

Nmap can scan private-address targets when the scanning host has network reachability to them. For example, on an authorized local network, a small-subnet host discovery scan could be:

nmap -sn 192.168.1.0/24

Run this only against a network you own or are explicitly authorized to assess. The /24 is only an example; the target prefix must match the authorized scope.

Nmap results apply to the scanner's current network position. A private address observed in local scan output does not identify a globally unique host. Scanning a private subnet across the public Internet is not possible merely by entering its RFC 1918 address. The scanner needs a valid path, such as local LAN access, an authorized VPN, or a private WAN connection.

Before changing scan options, inspect the route toward a private target:

ip route get 10.0.0.25
tracert 10.0.0.25

The first command is commonly used on Linux. The second is the Windows route-tracing command. Use the command appropriate to the platform and confirm that the target and path are within your authorization.

Conceptual NAT Design

A basic gateway design usually identifies these elements:

• An inside or private interface and subnet
• An outside or public interface
• An outbound source-translation or masquerading rule
• An optional inbound port-forwarding rule

Vendor-specific syntax differs between routers and firewalls, so the important addressing concepts are the inside network, outside network, translation policy, routing, and filtering policy.

Troubleshooting Private-Network Connectivity

A Private Address Does Not Respond from an Unrelated Internet Connection

• Confirm that the target is an RFC 1918 address and therefore is not publicly routed.
• Check whether the client is connected to the required internal network or authorized VPN.
• Inspect the route toward the target.
• Consider whether the target is behind NAT without an applicable inbound mapping.

Two VPN Sites Cannot Reach Each Other

• Compare the local and remote prefixes for identical or overlapping private ranges.
• Check whether local routing chooses the local subnet instead of the remote VPN route.
• Renumber one network or deploy a carefully designed translation approach.

An Internal Service Works Locally but Not from the Internet

• The service may have only a private address.
• Verify the intended exposure design at the gateway.
• Check for a public address, port-forwarding rule, firewall allowance, or reverse-proxy path.
• Do not treat the private IP as a public destination.

An Authorized Nmap Scan Finds No Hosts

• Confirm that the scanner is connected to a network that can route to the target subnet.
• Verify the target prefix and authorized scope.
• Check whether the target uses a different VLAN or VPN route.
• Remember that host discovery traffic may be filtered and that hosts may be offline.

Exam-Relevant Summary

• The three RFC 1918 blocks are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
• Only 172.16.0.0 through 172.31.255.255 is private within the broader 172.0.0.0/8 range.
• Private addresses can be reused by separate organizations because they are not globally unique.
• Private addresses are not globally routable on the public Internet.
• NAT commonly translates private outbound sources to public addresses, but NAT does not make a private address public.
• Inbound Internet access normally needs an explicit port-forwarding rule and suitable firewall policy.
• Nmap can scan private targets only when the scanner has a valid, authorized network path to them.

For related Nmap practice, see IP Address, Specify IP Address Range, Discover If a Host Is Online, and Interpret Scan Results.