Public vs Private IP Addresses, Explained for Business Owners

The short answer

Every device on your network is working with two different kinds of address at once, and almost all confusion here comes from mistaking one for the other. A private IP address is the number your router hands to each device inside your building - your laptop, phones, printer, cameras, access points. It usually looks like 192.168.1.42 or 10.0.0.15, it is only meaningful inside your own network, and it is never carried across the public internet. A public IP address is the single, globally unique number your Internet Service Provider assigns to your router's internet-facing side, and that is the address the rest of the world actually sees. So when your laptop reports 192.168.1.42 while a 'what is my IP' website shows something like 203.0.113.7, nothing is broken - you are simply looking at the two addresses that exist on the two sides of your router.

The bridge between them is NAT (Network Address Translation), which runs on virtually every business and home router. When a device with a private address requests a web page, the router rewrites the outgoing packet to use its one public address, records the translation, and rewrites the reply on the way back so it reaches the correct internal device. This is how dozens or hundreds of devices share a single public IP, and it is why the same private ranges can be reused in millions of networks without conflict - the 192.168.1.x in your office and the 192.168.1.x in the shop next door never collide because neither is visible outside its own walls. For a business owner the practical points are these: your public IP is what firewalls, VPNs, and remote-access rules key off; whether that address is static or dynamic decides whether you can reliably host services; and IP geolocation can place your public address in a city and name your ISP, but it cannot reveal your name or street address without a legal request to that provider.

Two Address Spaces: What Each One Is For

The internet runs on two separate pools of IPv4 addresses. Public (globally routable) addresses are unique across the entire internet - no two connected devices anywhere can legitimately share one at the same time. Private addresses come from three blocks reserved by RFC 1918 specifically for internal use; they are deliberately non-unique and are meant to be reused inside every organization's own network. This split exists mainly because IPv4 has only about 4.29 billion total addresses (2 to the 32nd power), which the world exhausted years ago - IANA handed its last large blocks to the regional registries in 2011. Private ranges plus NAT are what let a company with 300 devices consume just one or two public addresses instead of 300.

Public addresses flow down a chain of custody: IANA allocates large blocks to the five Regional Internet Registries (ARIN for North America, plus RIPE, APNIC, LACNIC, AFRINIC), which allocate to ISPs, which assign one or a small block to you. Because they are globally unique they are routable - backbone routers know how to reach them. Private addresses are the opposite: internet routers are configured to silently discard any packet whose source or destination is an RFC 1918 address, which is the technical reason a private IP physically cannot leave your network even if it wanted to.

IPv6, the 128-bit successor, changes this picture. It has so many addresses (about 340 undecillion) that every device can hold a globally routable address, so classic NAT is largely unnecessary. IPv6 still has a private-style range - Unique Local Addresses in fc00::/7 - but most IPv6 deployments give each device a real, internet-reachable address and rely on the firewall, not NAT, for protection.

• Public IP: globally unique and routable, assigned by your ISP, typically one (or a small block) per internet connection
• Private IP: reusable and NOT internet-routable, assigned locally by your router's DHCP server
• IPv4 has only ~4.29 billion total addresses; private ranges plus NAT relieve that shortage
• Backbone routers deliberately drop packets carrying RFC 1918 addresses, so private IPs cannot leave your LAN
• IPv6 (128-bit) gives nearly every device a globally routable address, sharply reducing the need for NAT

The Three Private IPv4 Ranges (RFC 1918)

There are exactly three private IPv4 blocks. 10.0.0.0/8 spans 10.0.0.0 to 10.255.255.255 and holds about 16.7 million addresses - a single huge block. 172.16.0.0/12 spans 172.16.0.0 to 172.31.255.255 (note: only 172.16 through 172.31, not 172.0 or 172.32) with about one million addresses. 192.168.0.0/16 spans 192.168.0.0 to 192.168.255.255 with 65,536 addresses. The number after the slash is CIDR notation: it states how many leading bits are fixed as the network portion, so /8 fixes the first 8 bits (the first octet), /16 fixes the first 16 bits (the first two octets), and the remaining bits are free for hosts.

Which block shows up where is largely convention. 192.168.0.0/16 is the default on nearly every home and small-office router, which is why 192.168.1.1 feels universal. 10.0.0.0/8 is favored in larger networks because its size gives clean room to carve out many subnets (per-site, per-VLAN, per-department). 172.16.0.0/12 turns up often as a default in virtualization and container platforms, so you may see it on VMware, Docker, or corporate VPN interfaces without anyone having chosen it deliberately.

A few other reserved ranges commonly appear and are worth recognizing. 169.254.0.0/16 is APIPA / link-local - a device self-assigns one when its DHCP request gets no answer, which almost always means a network fault. 100.64.0.0/10 is carrier-grade NAT (CGNAT) space your ISP may place you behind; it looks private but is controlled by the provider. 127.0.0.0/8 is loopback (127.0.0.1 is the device talking to itself). None of these are internet-routable.

• 10.0.0.0/8 - 10.0.0.0 to 10.255.255.255, ~16.7M addresses; one large block, most room for subnetting
• 172.16.0.0/12 - 172.16.0.0 to 172.31.255.255, ~1M addresses; only 172.16 through 172.31, common in VMs/containers
• 192.168.0.0/16 - 192.168.0.0 to 192.168.255.255, 65,536 addresses; the default on nearly all home/small-office routers
• 169.254.0.0/16 - APIPA/link-local; a device showing this failed to get a DHCP address
• 100.64.0.0/10 - carrier-grade NAT (CGNAT) space; ISP-controlled, not a true public IP
• The /8, /12, /16 suffix (CIDR) states how many leading bits are the fixed network portion

How NAT Lets Many Devices Share One Public IP

The form of NAT on virtually every router is PAT (Port Address Translation, also called NAPT). When an internal device opens a connection, the router replaces the private source IP and port with its own public IP and a chosen port, and records that mapping in a translation table - for example 192.168.1.42:51000 becomes 203.0.113.7:40000. Every device gets its own set of ports (there are 65,536 per IP), so one public address can multiplex many thousands of simultaneous conversations. When replies come back to 203.0.113.7:40000, the router looks up the table and rewrites the packet to reach 192.168.1.42:51000. The internal device never knows the translation happened.

A useful side effect is that unsolicited inbound traffic has no matching table entry, so the router has nowhere to send it and drops it. That gives NAT a firewall-like default of blocking incoming connections - but it is a side effect, not a real security policy, and it is no substitute for an actual firewall. It is also why hosting anything reachable from outside (a web server, a VPN endpoint, remote camera/NVR access) requires an explicit port-forward rule that tells the router which internal device should receive connections on a given public port.

Many ISPs now add a second layer called CGNAT (carrier-grade NAT), where the provider shares one public IP among many subscribers and puts each behind 100.64.0.0/10 space. This 'double NAT' saves the ISP public addresses but breaks inbound port forwarding, some VPNs, and peer-to-peer applications, because you no longer control a unique public address. You can spot it when your router's WAN address is in 100.64.0.0/10, or when the router's WAN IP does not match what an external IP-lookup reports. The fix is to ask the ISP for a real (often static) public IP.

• PAT maps each internal IP:port to the public IP:port and tracks it in a state table
• Return traffic is matched against that table and rewritten back to the correct internal device
• Unsolicited inbound connections have no table entry and are dropped - a side effect, not a real firewall
• Hosting a server behind NAT requires a port-forward rule (or an outbound reverse tunnel/relay)
• CGNAT (double NAT) shares one public IP across many subscribers and breaks port forwarding - ask the ISP for a real public IP if you host services

Why Your Device Shows 192.168.x.x but Websites See Something Else

When you run ipconfig on Windows, or ifconfig / ip addr on macOS and Linux, you are reading the address on that device's own network interface - which is the private LAN address your router's DHCP server leased to it. Your router is the only device that holds the public address, and it sits on the router's WAN (internet) interface, not on your laptop. So the private number is genuinely correct for the machine you are checking; it just is not the address the internet sees.

To see your public address accurately, either log into the router and read its WAN/internet status, or visit an external IP-lookup service. Those services simply reflect back the source address of the request they received - and because your traffic was translated by NAT on the way out, what they receive and report is your router's public IP. If the number your device shows and the number the website shows are different, that is the expected result and confirms NAT is working. Every device behind that one router will show its own private address but share the exact same public address to the outside world.

• ipconfig / ifconfig / ip addr report the private address on the device's own interface
• The public address lives on the router's WAN port - check the router's status page or an external lookup
• An online 'what is my IP' reflects the public source it received, i.e. your router after NAT
• A device showing 192.168 / 10 / 172.16 while the site shows a different number is normal and correct
• All devices behind one router share the same public IP as seen from outside

Static vs Dynamic IPs (and DHCP Reservations)

A dynamic IP is assigned automatically by DHCP for a fixed lease period and can change over time. This happens on two levels: inside your LAN, the router leases private addresses to your devices; and on the ISP side, the provider leases a public address to your router. A dynamic public IP can change when the lease renews, when the modem reboots, or after an outage - which is fine for browsing and email but a problem for anything that must be reached at a predictable address.

A static public IP is a fixed address your ISP guarantees will not change, usually as a paid add-on (business plans often include one, or offer a small /29 block of five usable addresses). You need one when something must be reachable or trusted at a stable address: an on-premises mail or web server, a site-to-site VPN, remote camera/NVR access, or a vendor or firewall that allow-lists your IP. Note that a 'DHCP reservation' is a different thing - it pins a specific private IP to a device's MAC address inside your LAN (best practice for printers, servers, and NVRs) but has nothing to do with your public address.

If you only have a dynamic public IP but occasionally need to reach your network from outside, Dynamic DNS (DDNS) is the common workaround. A small client on the router or a device reports the current public IP to a DDNS provider whenever it changes, and you connect to a stable hostname instead of a number. It is cheaper than a static IP but adds a moving part and a short update delay after each change.

• Dynamic IP: assigned by DHCP with a lease; can change over time on both the LAN side and the ISP side
• Static public IP: a fixed ISP-assigned address, usually an extra monthly fee; needed to reliably host services or terminate VPNs
• DHCP reservation: pins a private IP to a device's MAC address (great for printers/servers/NVRs) - NOT the same as a static public IP
• Firewall allow-lists and site-to-site VPNs assume the peer's public IP is stable, so dynamic IPs break them
• Dynamic DNS maps a hostname to your changing public IP as a lower-cost alternative to a static IP
• Business plans often include one static IP or offer a small /29 block (five usable addresses)

What IP Geolocation Can and Cannot Reveal

IP geolocation works by looking your public address up in commercial databases that map blocks of IPs to their registered owner and to a location inferred from registry records, ISP-published data, and network measurements. A lookup typically returns country, region/state, an approximate city, the ISP or organization name, the ASN (autonomous system number), and often a timezone. Crucially, none of this comes from your device's GPS - it is inference about where the address block is used, not a fix on your physical location.

The limits matter. Country-level accuracy is high (commonly cited around 95-99%), but city-level accuracy is far weaker and frequently lands on the ISP's regional hub rather than your actual location, sometimes miles off. VPNs, proxies, mobile carriers, and CGNAT distort results heavily - a VPN can place you in another country entirely. And geolocation never reveals your name, your street address, or which specific device made the request; the only record tying a public IP to a real subscriber lives with the ISP, and they release it only under a valid legal request such as a subpoena or court order.

Your private addresses reveal nothing to outsiders at all. Because 192.168 / 10 / 172.16 addresses never leave your network, they carry no external location data and are simply invisible to any website or third party. For a business, expect any geolocation of your connection to reflect your ISP's registered city and network rather than your exact office address.

• Reveals: approximate city/region, country, ISP/organization, ASN, timezone - from database inference, not GPS
• Does NOT reveal: your name, street address, or specific device - those require a legal request to the ISP
• City-level accuracy is often wrong or points at the ISP's regional POP; country-level is usually reliable
• VPNs, proxies, mobile carriers, and CGNAT can place you hundreds of miles from your real location
• Your private IP (192.168 / 10 / 172.16) is invisible externally and carries no location data
• Business connections often geolocate to the ISP's city, not your actual premises

Frequently asked questions