10.0.0.0/8: private address space

10.0.0.0/8 is the largest of the three private IPv4 ranges reserved by RFC 1918. It covers 10.0.0.0 to 10.255.255.255, which is 16,777,216 addresses. Routers on the public internet drop traffic addressed to it, so any organisation can use it internally without asking anyone.

Where the block came from

Before 1996 the range was a class A network allocated to ARPANET. When ARPANET was decommissioned the block came back, and RFC 1918 designated it as private along with 172.16.0.0/12 and 192.168.0.0/16. The authors chose one block from each historical class so that networks of every size had somewhere to go.

The RFC’s own reasoning is worth reading. It argues that most hosts in an enterprise need connectivity only within the enterprise, and that spending globally unique addresses on them wastes a finite resource. Written a decade before IPv4 exhaustion became urgent, it turned out to be the single largest factor in how long IPv4 lasted.

Why large networks pick it

A /8 leaves 24 bits for internal structure, which allows a scheme that survives growth. A common pattern assigns the second octet to a site, the third to a VLAN or function, and the fourth to hosts: 10.20.30.0/24 reads as site 20, VLAN 30. Doing the same in 192.168.0.0/16 leaves only 8 bits for both site and function, which forces a renumbering as soon as the organisation grows.

Cloud platforms follow the same logic. An AWS VPC, a Google Cloud VPC, or an Azure virtual network is typically numbered from 10.0.0.0/8, and Kubernetes clusters carve pod and service ranges out of it.

Plan a scheme with /subnet-calculator before assigning anything, because the second and third octets are difficult to change once DHCP scopes, firewall rules, and monitoring depend on them.

When you see it

• On a Comcast Xfinity gateway, where 10.0.0.1 is the default LAN address and clients get 10.0.0.x.
• Inside corporate networks, in ipconfig output on a work laptop.
• In VPN tunnels, where the remote network is announced as a 10.x route.
• In docker network inspect and Kubernetes cluster CIDRs.
• In cloud instance metadata, as the private address of a virtual machine.
• In traceroute output, as the first hops before traffic reaches the ISP.

The overlap problem

Because everyone can use 10.0.0.0/8, everyone does, and the collisions surface when two networks join. A remote worker whose home router uses 10.0.0.0/24 connects to a corporate VPN that also announces 10.0.0.0/24, and the laptop cannot tell whether 10.0.0.5 is the printer downstairs or a server at the office. Company mergers hit the same problem at a larger scale, and the resolution is either renumbering one side or double NAT on the tunnel, both expensive.

Choosing an unusual subnet for a home network, such as 10.157.42.0/24, makes a future VPN collision much less likely. The same advice applies to picking something other than 192.168.1.0/24.

What it is not

10.0.0.0/8 is not routable on the internet, so a 10.x address will never appear in a web server’s log as a visitor unless a proxy forwarded it in a header. It is not your public IP. It is not more secure than any other range: private addressing is a routing property, not a firewall, and a compromised device inside the network reaches every other 10.x host just fine. And 10.0.0.0/8 is not the same as 100.64.0.0/10, which your ISP assigns for carrier NAT rather than your own equipment.