Private IP Ranges Reference
Every reserved IPv4 block: RFC 1918, CGNAT, loopback, link-local, multicast. With which-to-pick guidance.
The reserved IPv4 blocks, complete
These are all the IPv4 ranges that aren't publicly routable on the internet. Memorizing the top three (RFC 1918) covers 95% of real-world use, but the other rows occasionally bite you.
| Range | CIDR | RFC | Use |
|---|---|---|---|
| 10.0.0.0 – 10.255.255.255 | 10.0.0.0/8 | RFC 1918 | Private — large networks |
| 172.16.0.0 – 172.31.255.255 | 172.16.0.0/12 | RFC 1918 | Private — mid-size networks |
| 192.168.0.0 – 192.168.255.255 | 192.168.0.0/16 | RFC 1918 | Private — home and small office |
| 100.64.0.0 – 100.127.255.255 | 100.64.0.0/10 | RFC 6598 | CGNAT (carrier-grade NAT) |
| 127.0.0.0 – 127.255.255.255 | 127.0.0.0/8 | RFC 1122 | Loopback (localhost) |
| 169.254.0.0 – 169.254.255.255 | 169.254.0.0/16 | RFC 3927 | Link-local (APIPA — DHCP failure) |
| 0.0.0.0 – 0.255.255.255 | 0.0.0.0/8 | RFC 1122 | "This network" — unspecified source |
| 224.0.0.0 – 239.255.255.255 | 224.0.0.0/4 | RFC 5771 | Multicast |
| 240.0.0.0 – 255.255.255.254 | 240.0.0.0/4 | RFC 1112 | Reserved (Class E) |
| 255.255.255.255 | 255.255.255.255/32 | RFC 919 | Limited broadcast |
| 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 | — | RFC 5737 | TEST-NET (use in documentation) |
| 198.18.0.0 – 198.19.255.255 | 198.18.0.0/15 | RFC 2544 | Benchmark testing |
RFC 1918 — the three you'll actually use
For private networks behind NAT, pick from these three. The choice usually comes down to:
- 192.168.0.0/16 — what consumer routers default to. Easy to memorize. Use it for home and small office unless you have a reason not to.
- 10.0.0.0/8 — vastly bigger, useful when you need many subnets (e.g., enterprise VLANs, multiple sites with site-to-site VPN, container networks). Common to see
10.<site>.<vlan>.0/24. - 172.16.0.0/12 — least common, makes a good "neutral" choice for VPN-connected networks since it's less likely to overlap with someone else's home or office network.
If you ever VPN into your home network from a coffee shop, hotel, or relative's house, your home subnet will conflict with theirs if both use 192.168.1.0/24. This is the #1 cause of "VPN connects but I can't reach anything" issues. Pick something less common at home (10.42.0.0/24, 172.20.0.0/24, etc.) to dodge the conflict.
CGNAT (100.64.0.0/10) — why your router shows a "weird" IP
If your home router's WAN side shows an address starting with 100.64–100.127, your ISP is using CGNAT. They're sharing one public IP across many customers. Implications:
- Port forwarding from the internet won't work (no public IP to forward from).
- Some games and VoIP have NAT traversal issues.
- The fix is asking your ISP for a real public IP — usually free if you ask, sometimes a small extra fee.
Why RFC 1918 exists and what it saved
The three private IPv4 blocks — 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 — were reserved in 1996 by RFC 1918 to solve a specific problem: the internet was running out of IPv4 addresses much faster than expected, and most organizations didn't actually need globally-unique addresses for the vast majority of their internal devices. The compromise was to reserve address blocks that anyone could use internally, on the understanding that they'd never be routed on the public internet.
This trick, combined with Network Address Translation (NAT), extended IPv4's usable life by decades. Instead of every home computer needing its own public IP, a household could have dozens of devices behind one public IP with the router translating between the shared public address and the internal RFC 1918 addresses.
The tradeoff — the whole architectural weirdness of NAT, port forwarding, and the endless problems with peer-to-peer connectivity — is the cost we've paid for extending IPv4's lifespan. IPv6 eliminates the need for private addresses at the internet-facing level (there's enough IPv6 space that every device can have a globally-unique address), but IPv4 with NAT is going to be around for a long time yet.
Which block to use when
10.0.0.0/8 — for larger deployments
16.7 million addresses. Enough for the biggest enterprise deployments many times over. Used routinely for corporate networks, cloud environments, and complex homelabs.
Common practice: allocate specific /16 blocks within the /8 for different sites or purposes. 10.1.0.0/16 for the main office, 10.2.0.0/16 for the second office, 10.10.0.0/16 for the datacenter, etc. Within each /16, subdivide into /24s per VLAN or per purpose.
The tradeoff of 10.0.0.0/8 versus the smaller ranges: more room for planned growth, but also easier to make mistakes (typing 10.1.2.3 versus 10.1.20.3 is a small typo with big consequences).
172.16.0.0/12 — the underused one
About a million addresses. Docker uses this range by default for bridge networks, which is why some Docker users see 172.17.0.0/16 in their network configurations. Otherwise this range sees relatively little use compared to 10.x and 192.168.x.
Some organizations deliberately use 172.16-31.x for isolation from more common 10.x and 192.168.x deployments, which reduces the chance of subnet collision when connecting via VPN to other networks.
192.168.0.0/16 — the home range
65,536 addresses. Every consumer router uses a /24 out of this range by default. 192.168.0.0/24 and 192.168.1.0/24 are the two most common defaults. Larger businesses use it too but often step up to 10.x when they need more room.
Other reserved blocks worth knowing
Loopback (127.0.0.0/8)
Every address in 127.x.x.x refers to the local host. 127.0.0.1 is the classic. The whole /8 is reserved, which is a lot of address space dedicated to the concept of "this machine," but that's what the original architects decided.
Link-local (169.254.0.0/16)
Auto-assigned when DHCP fails. Windows calls this "APIPA" (Automatic Private IP Addressing). Devices with these addresses can talk to each other on the same LAN segment but can't route anywhere. Seeing this address usually indicates a broken DHCP configuration.
Multicast (224.0.0.0/4)
Reserved for multicast group addresses. Used by protocols like mDNS (Bonjour), various discovery protocols, and IPTV.
Documentation (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24)
Reserved by RFC 5737 for use in documentation and examples. Never routed on the internet. Using these in real configurations is fine but confusing (they'll appear in books and tutorials as example addresses).
Benchmarking (198.18.0.0/15)
Reserved by RFC 2544 for internal network benchmarking. Shouldn't appear in normal configurations.
Broadcast (255.255.255.255)
Limited broadcast address. Packets to this address are delivered to every host on the local segment but not routed further.
CGNAT specifically (100.64.0.0/10)
Reserved by RFC 6598 for Carrier-Grade NAT. When your ISP puts multiple customers behind a shared public IP, the intermediate space between your router and the ISP's edge often uses this range. If your router's WAN interface shows an IP starting with 100.64 through 100.127, you're behind CGNAT.
CGNAT is why some services (self-hosting, inbound VPN, port forwarding) don't work on some connections despite the router being configured correctly. The CGNAT Detection tool checks specifically for this situation.
Common mistakes with private addresses
Using them on the public internet
Not really a mistake because it doesn't work — routers on the public internet drop packets destined for RFC 1918 addresses. But sometimes appears in configurations where the operator misunderstands the boundary between internal and external.
Subnet collisions between sites
Two offices both using 192.168.1.0/24, then trying to connect them via VPN. The routing gets ambiguous because both sides claim the same address space. Fix: renumber one side before setting up the VPN.
Docker or VM networks that conflict with the host LAN
Docker defaults to 172.17.0.0/16. If your LAN also uses 172.17.x.x, you have a conflict. Similarly for VM bridge networks that overlap with the host's LAN. Solution: reconfigure whichever side you control.
Assuming private = secure
RFC 1918 addresses aren't inherently secure. They're not routable on the public internet, which prevents direct external attack, but any device inside the network can reach any other device unless firewalls restrict it. VLAN segmentation and internal firewalls are how you get real isolation, not the private-address bit.
IPv6 and the end of NAT
IPv6 has enough address space that every device can have a globally-unique address. IPv6 native networks don't need NAT for the "we don't have enough addresses" reason.
IPv6 does have a private-address analog: Unique Local Addresses (ULA) in fc00::/7. These serve the same "not routable on the public internet" purpose but exist primarily for network isolation, not address exhaustion. Most IPv6 deployments use routable addresses everywhere and rely on firewalls (rather than NAT) for security.
Related tools
For working with private-address planning, the Subnet Calculator and CIDR Range Tool handle the math. The Default Router IPs reference shows the specific gateway addresses common consumer routers ship with. The CGNAT Detection tool identifies whether your ISP has put you behind carrier-grade NAT.