What Is the Difference Between Public and Private IP Addresses?

Every device connected to a network needs an IP address to send and receive data. A public IP address identifies that device on the global internet, while a private IP address identifies it only inside a local network such as a home or office LAN. The distinction determines whether your traffic can be reached directly from anywhere in the world or remains hidden behind a router.

What is a public IP address?

A public IP address is a globally unique, routable number assigned by an Internet Service Provider or regional registry. It allows a device or network edge to communicate directly with any other public address on the internet. Without one, a router cannot originate traffic onto the global routing table.

Because the supply of IPv4 public addresses has been exhausted for years, ISPs now often share them among many customers. Large providers deploy Carrier-Grade NAT (CGNAT), mapping entire neighborhoods through a single public IPv4 using an extra translation layer sometimes called NAT444. Cloudflare research on detecting CGNAT explains how widespread this practice has become.

IPv6 changes the equation entirely. A device on a dual-stack network can receive its own global unicast IPv6 address, restoring end-to-end reachability without shared address pools.

What is a private IP address?

A private IP address comes from reserved ranges that routers never forward directly onto the public internet. For IPv4, these ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, defined in RFC 1918. A home router can assign 192.168.1.5 to a laptop today, and an office in another country can assign the same address to a printer tomorrow without conflict because the two networks are disconnected.

Inside a single LAN, these addresses work for file sharing, printer discovery, and local server access. They simply cannot be contacted from the wider internet unless a NAT device or firewall explicitly forwards traffic inward.

IPv6 offers a parallel concept called Unique Local Addresses (ULA). These sit in the fc00::/7 block, typically fd00::/8 with a randomly generated 40-bit global ID. Unlike IPv4 private ranges, the randomness makes accidental collisions unlikely when two organizations later merge networks or connect via VPN.

How NAT bridges private and public networks

Network Address Translation (NAT) is the mechanism that lets an entire LAN share one public IP. When a laptop at 192.168.1.10 requests a web page, the home router rewrites the source address to its own public IP and records the port number in a translation table. When the response returns, the router reads that table, reverses the mapping, and delivers the packet to the correct internal device.

In a CGNAT environment, the process repeats. The customer's router might hold a 100.64.x.x address from the ISP, itself a private range defined in RFC 6598. The ISP's edge equipment then translates again to a true public IPv4. This double layer conserves scarce IPv4 space but breaks unsolicited inbound connections by default. It also complicates traceability, though modern CGNAT gear keeps session logs for abuse complaints.

Return traffic relies entirely on connection tracking tables. If a packet arrives at the public interface with no matching outbound session, the NAT device drops it. That behavior acts as a crude firewall, which is why home devices behind private IPs are shielded from random internet scans and worms.

Key differences at a glance

Public addresses must be globally unique. Private addresses are reused endlessly across LANs. The former exposes a device to the global routing system. The latter hides it behind a boundary.

From a security perspective, public IPs present a larger attack surface because ports and services face the internet directly. Private IPs don't guarantee safety, but the NAT boundary blocks inbound probes that lack an explicit forwarding rule.

For developers and gamers, the practical gap is reachability. A service on a public IP is directly accessible. A device behind CGNAT often cannot receive inbound connections at all, requiring VPNs, cloud relays, or NAT traversal protocols like STUN and TURN.

How to check your public and private IP addresses

Finding your public address is straightforward. Web-based tools show the address seen by remote servers. You can also run deeper checks with the Digtrace IP Checker.

$ curl -s checkip.amazonaws.com
203.0.113.45

To find your private address, inspect the local interface configuration.

# On Linux or macOS
$ ip addr show | grep "inet "
inet 192.168.1.105/24 brd 192.168.1.255 scope global dynamic noprefixroute eth0

# On Windows PowerShell
PS C:\> Get-NetIPAddress -AddressFamily IPv4 | Where-Object {$_.IPAddress -like "192.168.*" -or $_.IPAddress -like "10.*"}
IPAddress         : 192.168.1.105

If the public address returned by an external site falls within 100.64.0.0/10, you're likely behind CGNAT.

Private and public addressing in modern networks

The line between public and private continues to blur as IPv4 scarcity forces more layers of translation. Yet the core concept remains unchanged. Public space is routable and unique. Private space is local and reusable. Engineers have simply stacked more boxes between the two.

IPv6 was designed to eliminate the shortage altogether. Dual-stack networks assign global unicast addresses to individual devices while reserving ULAs for internal services that should never leave the LAN. That separation preserves the security benefits of boundary addressing without the port-translation hacks and broken checksums that IPv4 NAT requires.

Whether you're troubleshooting a home connection or designing a corporate topology, knowing which side of the NAT boundary an address lives on determines how packets flow, who can initiate connections, and what troubleshooting tools apply. You can learn more about the basics in our guide to what an IP address is, or browse the IP address section.