VMware ESXi and vSphere Cluster Management
Private IPv4 Addresses and Internet Routing
Learn what private IPv4 addresses are, the RFC 1918 ranges, how subnets work, and how NAT lets private networks access the Internet.
An IPv4 address is a 32-bit network-layer address used to identify an interface on an IPv4 network. IPv4 addresses are commonly written in dotted-decimal notation, such as 192.168.1.25.
This lesson explains private IPv4 addressing, why private addresses can be reused, how they differ from public addresses, and how Network Address Translation lets private hosts communicate with Internet services.
Why private IPv4 addresses exist
When the Internet was designed, it was reasonable to expect that Internet-connected hosts would receive globally unique IPv4 addresses. A globally unique address is different from every other public Internet address, and a public IP address is intended to be routable across the Internet.
That model does not scale well. IPv4 has a finite address space of about 4.3 billion possible addresses, and many addresses are reserved for special purposes. Modern homes, businesses, cloud environments, laboratories, and mobile networks may contain many more devices than the organization needs to expose directly to the Internet.
Assigning one public IPv4 address to every internal device would consume the limited address space quickly. Private addressing conserves public IPv4 addresses by allowing many internal devices to use addresses that are not allocated as unique Internet endpoints.
What is a private IPv4 address?
A private IP address is an IPv4 address from a reserved private-use range. It is intended for communication within an organization or other private network rather than for direct global Internet routing.
Private addresses are suitable for internal hosts, home networks, enterprise LANs, lab environments, and isolated networks. Different organizations may reuse the same private addresses because those addresses do not need to be globally unique.
For example, a home router might assign 192.168.1.25 to a laptop. A business, school laboratory, or another home could also use 192.168.1.25 internally. The matching addresses do not conflict while the networks remain separate.
RFC 1918 private IPv4 ranges
RFC 1918 defines three private-use IPv4 blocks. CIDR notation places a slash after an address to state how many leading bits form the network prefix. For example, /24 means that 24 bits identify the network portion.
The /8 block is the largest, followed by the /12 block and then the /16 block. The prefix length explains this: a shorter prefix leaves more bits available for addresses.
<A common range mistake
Not every address beginning with 172 is private. Only 172.16.0.0 through 172.31.255.255 belongs to the RFC 1918 private range. For example, an address outside that interval may be public or reserved for another purpose.
Private addresses are not globally unique
Private address space has non-global uniqueness. This means the same private subnet can exist simultaneously in multiple independent networks.
Organization A may use 10.0.0.0/24 internally and assign 10.0.0.10 to a workstation. Organization B may also use 10.0.0.0/24 and assign 10.0.0.10 to one of its own workstations. There is no conflict because the two networks are separate. Each organization's local routers interpret 10.0.0.10 within their own network.
Duplicate private addresses become a problem when the networks are connected without a plan. For example, a VPN that joins both organizations, or a merger that connects their LANs, can create overlapping routes and duplicate host addresses. One network may need renumbering, or a deliberate address-translation design may be required.
Private versus public IPv4 addressing
Routable means capable of being forwarded through routing infrastructure toward a destination network. A private address can be routed inside a private organization, but it is not intended to be routed across the public Internet.
Private addresses and Internet routing
Routers inside a private network can forward packets between private subnets. A host can also send traffic to a different network through its default gateway, which is the router used for destinations outside the host's local subnet.
At the boundary with the Internet, the situation changes. Private IPv4 ranges are not publicly routable. Internet-facing routers should not forward packets with private source or destination addresses across the public Internet. This prevents unrelated networks from treating the same private address as a unique global destination.
Local routing and global routing are therefore different scopes. A route such as 10.0.0.0/24 can be meaningful inside one organization, while an Internet router cannot use that address as a unique destination for the whole world.
How NAT provides Internet access
Network Address Translation (NAT) is a gateway process that modifies address information between private and public network domains. It is the usual mechanism that allows private-addressed hosts to communicate with public Internet services.
Suppose a laptop has the private address 192.168.1.25. When it connects to a website, the home router receives the packet, translates the laptop's private source address to the router's public-facing address, and sends the translated traffic to the Internet. The website sees the router's public address rather than 192.168.1.25.
The router keeps enough translation state to associate returning traffic with the internal laptop. The exact details, including port translation, are follow-on NAT topics. The important point here is that NAT translates traffic at the network boundary; it does not make the private address globally routable.
Example: a home network
A typical illustrative configuration might look like this:
Host address: 192.168.1.25/24
Default gateway: 192.168.1.1
DNS server: 192.168.1.1The laptop uses the router at 192.168.1.1 for destinations outside 192.168.1.0/24. The router has a separate public address on its WAN connection and performs NAT for outbound Internet traffic. Exact values depend on the local network.
Understanding a network range and a host address
A listed private block is a range of addresses, not a statement that every address can automatically be assigned to a host. A subnet is a logical IPv4 network defined by an address and a prefix length. The prefix determines which addresses belong to that subnet and how they are used.
Example: 10.0.0.0/24
For the subnet 10.0.0.0/24:
- Network address: 10.0.0.0 identifies the subnet itself.
- Usable host range: 10.0.0.1 through 10.0.0.254 in conventional IPv4 subnetting.
- Broadcast address: 10.0.0.255 sends traffic to all hosts on that subnet where IPv4 broadcast is supported.
- Total addresses: 256 addresses, including the network and broadcast addresses.
Thus, 10.0.0.10 can be an individual host address in this /24 subnet, while 10.0.0.0 refers to the subnet and 10.0.0.255 is the broadcast address.
Two organizations using the same subnet
Consider two separate organizations:
- Organization A uses 10.0.0.0/24 internally and assigns 10.0.0.10 to a workstation.
- Organization B also uses 10.0.0.0/24 internally and assigns 10.0.0.10 to a workstation.
- Each organization connects to the Internet through its own edge router and public address.
- The two internal networks remain independent, so each local 10.0.0.10 has meaning only inside its own organization.
If the organizations later connect their networks, their overlapping address plans can prevent reliable routing between the duplicate subnets. Private reuse is safe when the networks are isolated, not when duplicate address spaces must communicate directly.
Checking a private network configuration
On Linux, use these commands to inspect local addressing and the routing table:
ip addr
ip routeOn Windows, use:
ipconfigTo test the local gateway, ping the actual configured default gateway. The following address is only an example:
ping 192.168.1.1Testing the gateway first helps separate local network problems from Internet or DNS problems.
Troubleshooting private-address Internet access
A device has a private address but cannot open a website
Check the problem in layers:
- Confirm the assigned IPv4 address and prefix length.
- Confirm that the default gateway is present and correct.
- Test reachability to the gateway before testing an external destination.
- Check whether NAT is configured and working on the edge router.
- Test IP connectivity separately from DNS name resolution.
- Check firewall rules and confirm that the device is connected to the intended subnet or VLAN.
A private address by itself does not guarantee Internet access. The host also needs a usable local configuration, a working gateway, a functioning NAT path, and appropriate security policy.
Two devices with the same private address cannot communicate
If both devices are on the same Layer 2 network, the duplicate address creates an address conflict. The same problem can appear after a VPN or network merger joins two formerly separate networks that reused the same private space.
Private address reuse is safe only while the duplicate addresses remain isolated. If the networks must connect, renumber one network or use a deliberate translation design.
Exam-relevant points
- RFC 1918 private blocks are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
- Only 172.16.0.0 through 172.31.255.255 is private within the 172.x.x.x space.
- Private addresses can be reused by unrelated networks because they are not globally unique.
- Private addresses are not publicly routed across the Internet.
- NAT translates private traffic at a gateway; it does not make private addresses public or globally routable.
- For 10.0.0.0/24, the network address is 10.0.0.0, typical host addresses are 10.0.0.1 through 10.0.0.254, and the broadcast address is 10.0.0.255.
- A private address does not automatically mean that the host can reach the Internet. Gateway, NAT, DNS, firewall, and VLAN configuration also matter.
For a concise reference to this subject, see Private IP Addresses.