SubnetKit › Private IP Address Ranges Explained
Private IP Address Ranges Explained: how it works
RFC 1918 reserves three blocks of IPv4 space for use inside private networks. They are never routed on the public internet, which is why every home, office and cloud VPC can reuse them behind NAT.
The blocks are easy to misremember, especially the 172 range. SubnetKit lets you type any address and CIDR to check membership, free and in the browser; the calculator above is set to test 172.20.5.1 against 172.16.0.0/12.
The three RFC 1918 blocks
- 10.0.0.0/8 — 10.0.0.0 to 10.255.255.255, mask 255.0.0.0, 16,777,216 addresses. Used by large enterprises and most cloud VPCs.
- 172.16.0.0/12 — 172.16.0.0 to 172.31.255.255, mask 255.240.0.0, 1,048,576 addresses. Docker's default bridge networks come from here.
- 192.168.0.0/16 — 192.168.0.0 to 192.168.255.255, mask 255.255.0.0, 65,536 addresses. Home routers and small offices.
The 172 block is the one people get wrong: 172.15.0.1 and 172.32.0.1 are public addresses. Only second octets 16 through 31 are private, because /12 leaves four bits of the second octet for the network, and 16 = 00010000 through 31 = 00011111 share the same top four bits.
Other reserved ranges that look private
- 100.64.0.0/10 (100.64.0.0–100.127.255.255): shared address space for carrier-grade NAT, RFC 6598. If your router's WAN address is here, your ISP is using CGNAT and port forwarding will not work.
- 169.254.0.0/16: link-local, self-assigned when DHCP fails (RFC 3927). Seeing one on a client almost always means a DHCP problem.
- 127.0.0.0/8: loopback; 127.0.0.1 is the usual address but the whole /8 points at the local host.
- 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24: documentation ranges that are public but never assigned, safe for examples.
When designing a network, pick a block that will not collide with networks you may later connect to over VPN. 10.0.0.0/8 and 192.168.0.0/16 overlap frequently; a less common slice such as 172.22.0.0/16 reduces that risk.
Frequently asked questions
Is 172.32.0.1 a private IP address?
No. The private range 172.16.0.0/12 ends at 172.31.255.255; 172.32.0.0 onward is public space.
How many private IPv4 addresses are there in total?
17,891,328: 16,777,216 in 10.0.0.0/8, 1,048,576 in 172.16.0.0/12 and 65,536 in 192.168.0.0/16.
Can I use 100.64.0.0/10 inside my LAN?
It is reserved for ISP carrier-grade NAT and may conflict with your provider's addressing. Use one of the RFC 1918 blocks for internal networks.
Are private addresses the same in IPv6?
The equivalent is Unique Local Address space, fc00::/7, in practice fd00::/8 with a random 40-bit global ID. Unlike IPv4, most IPv6 LANs use public global unicast addresses instead.
Looking for the full guide, tips and the complete FAQ? Read the main SubnetKit page.