Public vs private IP addresses

Check the public one on the homepage or in the full report. Find the private one with the device guides linked at the end.

The private ranges reserved by RFC 1918

RFC 1918 set aside three IPv4 blocks in 1996. Routers on the public internet drop traffic addressed to them, so any network can reuse them without coordinating with anyone.

Block	Range	Addresses	Where you meet it
10.0.0.0/8	10.0.0.0 to 10.255.255.255	16,777,216	Corporate networks, VPN tunnels, Comcast Xfinity gateways
172.16.0.0/12	172.16.0.0 to 172.31.255.255	1,048,576	Docker’s default bridge, mid-size campus networks
192.168.0.0/16	192.168.0.0 to 192.168.255.255	65,536	Almost every consumer router

Home routers usually carve one /24 out of the last block, such as 192.168.1.0/24, keep .1 or .254 for themselves, and hand the rest out over DHCP.

Addresses that are neither public nor private

Several other blocks are special-purpose. IANA tracks all of them in the IPv4 Special-Purpose Address Registry.

Block	Name	Defined in	What it means
127.0.0.0/8	Loopback	RFC 1122	The machine talking to itself. 127.0.0.1 never leaves the host.
169.254.0.0/16	Link-local	RFC 3927	Self-assigned when DHCP fails. Windows calls it APIPA. A sign your router did not answer.
100.64.0.0/10	Shared address space	RFC 6598	Carrier-grade NAT. Your ISP assigns it to your router, not to the internet.
192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24	Documentation	RFC 5737	Examples in specs and articles. Never routed.
fc00::/7	Unique local (IPv6)	RFC 4193	The IPv6 answer to RFC 1918. In practice you see fd00::/8.
fe80::/10	Link-local (IPv6)	RFC 4291	Present on every IPv6 interface, valid only on that one link.

Everything left over is globally routable. That is what “public” means: reachable from anywhere, and unique across the whole internet.

How to tell which address you are looking at

Read the first octet, then the second.

• Starts with 10. : private.
• Starts with 192.168. : private.
• Starts with 172. and the second number is 16 through 31: private. 172.15.x.x and 172.32.x.x are public.
• Starts with 100. and the second number is 64 through 127: carrier NAT, not yours and not public.
• Starts with 169.254. : your device gave up on DHCP.
• Anything else: public. Paste it into /ip-lookup to see who announces it.

For IPv6 the shortcut is the prefix. fe80: is link-local, fd is unique local, and a 2000::/3 address (anything starting with 2 or 3) is global.

Why NAT makes one public address enough

Network address translation, described in RFC 2663 and RFC 3022, lets your router swap the private source address for its own public one on the way out, record the mapping, and reverse it on the way back. Thirty devices share one address because each conversation gets its own source port.

The cost is that inbound connections have nowhere to go by default. That is why port forwarding exists, and why a game server or a home NAS needs an explicit rule.

When your public IP is not actually public

If your router’s WAN address starts with 100.64 through 100.127, your ISP put you behind carrier-grade NAT and you share one public address with other subscribers. RFC 6269 lists the consequences: no inbound port forwarding, shared reputation with strangers, and geolocation that points at the carrier’s aggregation site rather than your town.

The quick test: compare the WAN address on your router’s status page with the address shown on this site. If they differ and the WAN one is in 100.64.0.0/10, that is CGNAT. If they differ and the WAN one is RFC 1918, you have a second router upstream and you are double-NATed.

IPv6 changes the shape of the problem

An IPv6 host normally gets a global address directly, so there is no translation and no private-to-public boundary. Your laptop’s IPv6 address is the address the server sees. Privacy extensions (RFC 8981) rotate the host part of that address regularly so the same device does not stay trackable, but the network prefix still identifies your connection.

Dual-stack machines hold both at once: an RFC 1918 IPv4 address behind NAT and a global IPv6 address in front of it. Which one a website records depends on which protocol the connection used. Check both on /ipv6-test.