VMware ESXi and vSphere Cluster Management

Private IPv4 Addresses: RFC 1918 Ranges and Internet Routing

Learn the three RFC 1918 private IPv4 ranges, how private and public addresses differ, why private addresses are not Internet-routable, and how NAT enables Internet access.

A private IPv4 address is an IPv4 address reserved for use inside private networks. It is not globally unique and is not intended to be routed across the public Internet. The three private ranges are defined by RFC 1918.

This topic assumes familiarity with dotted-decimal IPv4 notation, network and host portions, subnet masks, CIDR prefixes, LANs, WANs, and basic router forwarding.

Why Private IPv4 Addresses Exist

An IPv4 address is a 32-bit logical address used to identify an IPv4 network interface. IPv4 provides a limited number of addresses, and the rapid growth of networks made it impractical to assign a globally unique public address to every device.

Private addressing conserves public IPv4 space by allowing organizations to use internal addresses that do not need to be unique on the public Internet. Organization A and Organization B can both use the same private addresses because their internal networks are normally separate routing domains.

Private addresses are intended for internal organizational addressing. Public addresses are used when an interface or service must be identified across the Internet. A private address can be reused by unrelated homes, schools, businesses, and data centers.

The Three RFC 1918 Private IPv4 Ranges

RFC 1918 reserves three complete IPv4 blocks for private use. Each row identifies an address block, not one indivisible subnet. Network administrators can subdivide a block into smaller subnets using longer CIDR prefixes.

The CIDR prefix states how many leading bits identify the block. For example, 10.0.0.0/8 covers every address whose first octet is 10. The block may then be divided into subnets such as 10.20.0.0/16 or 10.20.1.0/24.

Private IPv4 Versus Public IPv4

A public IPv4 address is allocated from public address space, intended to be globally unique, and potentially routable across the Internet. “Routable” means that routers in a particular routing domain can forward traffic toward the destination.

A private IPv4 address comes from one of the RFC 1918 blocks and is intended for use within a private network. The same private address can identify different devices in many unrelated networks at the same time.

Private does not mean encrypted, automatically secure, or unreachable from every external source. A private address mainly describes its address scope and public routing treatment. Firewalls, access controls, segmentation, authentication, and encryption are still necessary.

Why Private Addresses Are Not Routed on the Public Internet

RFC 1918 source and destination addresses are not intended to cross the public Internet. Internet-facing routers and service providers commonly filter or reject traffic that uses these addresses, following anti-spoofing and routing policies.

Suppose a packet on the Internet has destination address 10.20.30.40. That address may exist inside thousands of separate organizations. There is no globally unique destination that tells Internet routers which organization should receive the packet. Consequently, a public Internet route cannot deliver the packet to one specific organization based only on that private destination address.

Private source addresses are also unsuitable as Internet identities. If a packet arrived at an Internet provider claiming to come from 192.168.1.10, the provider could not determine which private network actually originated it. Filtering such traffic helps prevent ambiguous routing and source-address spoofing.

Address Reuse in Separate Organizations

Imagine Organization A and Organization B both use 10.0.0.0/24 internally.

• Organization A might assign 10.0.0.10 to a workstation.
• Organization B might assign 10.0.0.10 to a different workstation.
• Both networks can operate normally while they remain separate.
• The duplicate address does not create a conflict because each organization has its own routers and routing domain.

The situation changes if the organizations later connect their networks through a site-to-site VPN, merger, or other link. If both sides advertise 10.0.0.0/24, a router cannot uniquely determine which copy of 10.0.0.10 a packet should reach. This is called overlapping address space.

Common solutions include renumbering one network, designing non-overlapping subnets before connecting the sites, or using an appropriate address-translation design. Renumbering is often the clearest long-term solution.

How NAT Relates to Private Addressing

NAT, or Network Address Translation, modifies address information as traffic crosses a network boundary. NAT is commonly used with private IPv4 addressing, but it is a separate technology and is not what defines an address as private.

For example, a home router might assign a laptop 192.168.1.10. When the laptop contacts a public website, the router can translate the internal source address to the router’s public-facing address. The website replies to the public address, and the router tracks the connection so it can send the response back to 192.168.1.10.

Inside host:       192.168.1.10:51500
Edge translation:  198.51.100.25:40001
Internet server:   203.0.113.80:443

This example shows the basic relationship, not a complete NAT configuration. NAT allows many private-addressed devices to share one or more public IPv4 addresses for outbound communication. Inbound access generally requires an explicitly published service, such as port forwarding, or a private-access method such as a VPN.

Recognizing RFC 1918 Addresses

The 172.16.0.0/12 Boundary

The /12 prefix fixes the first 12 bits. For practical dotted-decimal checking, the first octet must be 172 and the second octet must be from 16 through 31, inclusive. Therefore, every address from 172.16.0.0 through 172.31.255.255 is in the RFC 1918 block, while 172.15.x.x and 172.32.x.x are not.

Practical Network Examples

Home or Small-Office LAN

A router may assign 192.168.1.10/24 to a computer and use its Internet-facing interface to perform NAT. The computer uses the router as its default gateway. The computer can browse public websites, but its private address is not directly advertised as an Internet destination.

Enterprise Private Network

An organization might reserve 10.20.0.0/16 and divide it into smaller subnets for departments, floors, or VLANs. The /16 is an address-planning block; it can contain many smaller subnets with different prefix lengths.

Troubleshooting Common Misunderstandings

Every 172.x.x.x Address Is Private

This is incorrect. Only 172.16.0.0 through 172.31.255.255 is private. Check that the second octet is between 16 and 31 inclusive.

A 10.x.x.x Host Should Be Reachable From the Internet

A host using a 10.x.x.x address cannot normally be reached directly from the public Internet because that address belongs to RFC 1918 private space. Use a public address at the network edge with suitable NAT or port forwarding, or use a secure private-access method such as a VPN.

Private Addressing Alone Provides Security

Private addressing limits public Internet routing, but it does not replace firewall policies, access controls, segmentation, monitoring, or encryption. Devices on the same private network may still attack one another if other controls are absent.

Two Connected Networks Use the Same 192.168.1.0/24 Subnet

The overlapping routes create ambiguity: a router cannot uniquely select the remote host when both sides contain the same addresses. Renumber one network, adopt a non-overlapping private addressing plan, or use a carefully designed translation solution.

Exam-Relevant Summary

• RFC 1918 defines exactly three private IPv4 blocks: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
• The complete 172.16/12 range is 172.16.0.0 through 172.31.255.255.
• Private addresses are not globally unique and may be reused in isolated networks.
• Private addresses are not intended to be routed across the public Internet.
• NAT commonly translates private source addresses to a public-facing address for Internet access.
• NAT and private addressing are related but separate concepts.
• Private addressing does not automatically provide encryption or security.
• Overlapping private subnets become a problem when previously separate networks are connected.