172.16.0.0/12: private address space

172.16.0.0/12 is the middle private range reserved by RFC 1918. It covers 172.16.0.0 through 172.31.255.255, which is 1,048,576 addresses. Only those sixteen second octets are private: 172.15.x.x and 172.32.x.x are ordinary public addresses belonging to real organisations.

Why the boundaries look arbitrary

They are not arbitrary, they are binary. A /12 prefix fixes the first twelve bits of the address. The first octet uses eight of them for 172, leaving four bits fixed in the second octet. Those four bits are 0001, so the second octet ranges from 0001 0000 to 0001 1111, which is 16 to 31 in decimal.

RFC 1918 chose one block from each historical address class. 10.0.0.0/8 was a class A, 192.168.0.0/16 was a set of class C networks, and this range was sixteen contiguous class B networks. Written as CIDR it collapses into one /12.

Confirm any boundary with /subnet-calculator rather than trusting memory, because the off-by-one here appears in production firewall rules regularly. A rule written for 172.0.0.0/8 permits far more than intended, and a rule for 172.16.0.0/16 covers only a sixteenth of the range.

Where you actually meet it

Docker. The default bridge network is 172.17.0.0/16, and docker0 on the host carries 172.17.0.1. Each user-defined network takes the next available /16 from 172.18 upward. A container that cannot reach a corporate service is often a collision between one of those and a real internal subnet.

AWS. The default VPC in every region is 172.31.0.0/16, so an EC2 instance launched without a custom VPC has a 172.31.x.x private address. Anyone who has read an instance’s metadata has seen it.

Apple personal hotspots. An iPhone sharing its connection over Wi-Fi uses 172.20.10.1 as the gateway and hands out 172.20.10.x to clients.

Mid-size campus networks. Organisations too large for a /16 and unwilling to commit to a /8 often settle here.

When you see it

• In ip addr on a Docker host, on the docker0 interface.
• In ipconfig on a laptop tethered to an iPhone.
• In AWS console network tabs and instance metadata.
• In VPN route announcements from a corporate network.
• In firewall rules where the author wrote a /12 correctly, or a /8 incorrectly.

Planning around Docker

If your organisation uses 172.16.0.0/12 internally and your developers use Docker, the two will collide eventually. Docker’s default-address-pools setting in /etc/docker/daemon.json lets you move container networks somewhere harmless, for example into a slice of 10.0.0.0/8 that your network does not use. Doing this before the first support ticket is much easier than diagnosing why one team’s containers cannot reach the build server.

What it is not

172.16.0.0/12 is not the whole of 172. Addresses such as 172.104.x.x belong to Linode and 172.217.x.x belongs to Google, and treating them as private in a firewall rule creates a real hole. The range is not routable on the internet, so it will never be your public IP. And private addressing is not a security control: it prevents inbound routing, not lateral movement, and anything already inside the network reaches every other host in the range.

Look up an address to see which registry entry or organisation it belongs to with /ip-lookup.