Public vs private IP: NAT, CGNAT and what your IP reveals

Unique vs reusable addresses

The whole internet rests on one simple rule: every public address must be globally unique, otherwise routing has no idea where to send the packet. Private addresses invert that rule on purpose. They are not unique, they are reusable. The same 192.168.0.1 lives in the router of millions of homes at once, and nobody collides, because that number never leaves the local network. It is this difference of scope, not of format, that separates the two. Both look like four identical octets; what changes is where they mean something.

It is worth killing a vocabulary myth: a private IP is not “insecure” or “bad”, and a public one is not “better”. They are roles. The private one exists precisely so you do not burn a global public address every time you plug in a smart bulb. And because the public IPv4 space is finite and has run out, that thrift stopped being a convenience and became a necessity, as we will see when we reach NAT and CGNAT.

Which blocks are private, and why

RFC 1918 (February 1996) reserves three blocks for private use. Having them in three sizes is practical: a multinational uses the giant 10/8; a mid-size company, the 172.16/12; your home, a slice of 192.168/16. Together they are 17,891,328 addresses any network can reuse without asking anyone, because no router on the internet will forward them. Alongside them sit other blocks that are also not “normal” public addresses, and recognizing them saves confusion when you diagnose a problem.

Link-local (169.254.0.0/16)

The address a host gives itself when DHCP fails (APIPA). If your IP starts with 169.254, the router did not hand you one, it is a symptom, not a setting.

Loopback (127.0.0.1)

The machine’s “myself”: the packet never even touches a cable. The entire /8 is loopback, not just .0.0.1.

Documentation (TEST-NET)

Blocks reserved for examples (like the ones in this article), precisely so they never collide with anyone’s real addresses.

To plan how to carve one of these ranges into smaller subnets, how many hosts fit in a /26, where the network and broadcast addresses land, the subnet calculator does the math, and the CIDR and subnetting guide explains the mask behind it.

NAT for real: port, state table and the packet both ways

If private addresses do not travel the internet, how does your laptop open a website? Through NAT (Network Address Translation), performed by the router. There are two flavors. In basic NAT (1:1), a private address maps to a whole public address, an identity swap, one for one. What almost everyone actually uses, though, is NAPT (Network Address Port Translation), defined by RFC 2663 and detailed in RFC 3022: it multiplexes dozens of private hosts onto a single public IP, telling each flow apart by port. That is how an entire street browses on one address. The trick is a state table: for every outbound connection, the router records who asked, for where, and under which external port it rewrote the packet.

Basic NAT (1:1)

One private address ↔ one whole public address. Translates only the IP. Needs one public address per host going out at the same time.

NAPT / PAT (overload)

Many private ↔ one public, told apart by port. It is the “NAT” of your home router. Translates IP and port together.

State table

NAT’s memory: it links (internal IP:port, destination) to (external IP:port). With no entry, a returning packet has no idea who to go to.

Let us trace a real packet. Your host 192.168.0.10 picks an ephemeral source port, 51000, and wants to talk to a web server at 203.0.113.25:443. The router’s public IP is 198.51.100.7 (I use documentation addresses only). Follow the translation outbound and inbound, and note the last block: a packet arriving with no match in the table has no destination and is dropped. That drop is the technical reason inbound connections “don’t get through”.

// Exemplo trabalhado 1, tabela NAPT do roteador e o caminho do pacote
// Worked example 1, router NAPT table and the packet path

+----------------------+----------------------+--------------------+
| Interno (LAN)        | Externo (WAN)        | Destino / Dest.    |
+----------------------+----------------------+--------------------+
| 192.168.0.10:51000   | 198.51.100.7:47000   | 203.0.113.25:443   |
+----------------------+----------------------+--------------------+

IDA / OUTBOUND
  LAN  ->  src 192.168.0.10:51000   dst 203.0.113.25:443
  (o NAT reescreve a origem / NAT rewrites the source)
  WAN  ->  src 198.51.100.7:47000   dst 203.0.113.25:443

VOLTA / RETURN  (o servidor responde para o IP:porta externo)
  WAN  <-  src 203.0.113.25:443     dst 198.51.100.7:47000
  (o NAT procura a porta 47000 na tabela / NAT looks up port 47000)
  LAN  <-  src 203.0.113.25:443     dst 192.168.0.10:51000

ENTRADA NAO SOLICITADA / UNSOLICITED INBOUND
  WAN  <-  src ????                 dst 198.51.100.7:47000
  (sem par na tabela / no matching state entry)  ->  DESCARTADO / DROPPED

The myth: “I’m behind NAT, so I’m safe”

The drop you saw above looks like protection, and that is where the myth comes from. If unsolicited inbound connections fall, NAT must be a firewall, right? No. The drop is a side effect of there being no mapping, not a security policy. Nobody in NAT decided “this is malicious, block it”; there simply was nowhere to deliver the packet. The distinction matters because the same protection, and better, exists with no NAT at all, and vanishes the moment a mapping is opened.

CGNAT: when your “public” IP is not yours

IPv4 has run out, literally. IANA handed the last five /8 blocks to the regional registries on 3 February 2011, and since then each RIR drained its stock on different dates. With no public addresses to give each subscriber, providers began doing NAT en masse inside their own network: CGNAT (Carrier-Grade NAT). RFC 6598 (April 2012) reserved the 100.64.0.0/10 block precisely for this. The result: your router gets an address from that block (or an RFC 1918 one) on its WAN interface, and hundreds of customers share a handful of real public IPs up at the provider. The “my IP” you see is, in practice, rented and shared.

1. Feb 1996RFC 1918

   The private ranges are formalized, the first stopgap for IPv4 scarcity.

2. 1999–2001NAT/NAPT standardized

   RFC 2663 and RFC 3022 define the terminology and the traditional NAT running in your router.

3. 3 Feb 2011IANA depletes the central pool

   IANA hands the last five /8s to the RIRs; the global stock is gone.

4. Apr 2012RFC 6598, CGNAT

   The 100.64.0.0/10 block is reserved for carrier-grade NAT.

5. 6 Jun 2012World IPv6 Launch

   Major sites and providers turn on IPv6 for good, the real way out of the dead end.

6. 25 Nov 2019Europe (RIPE) runs dry

   The RIPE NCC makes its last /22 allocation; only transfers and waiting lists remain.

7. 2026IPv6 nears half of traffic

   IPv6 traffic measured by Google approaches 50%, but IPv4 and CGNAT are still going strong.

How do you know you are behind CGNAT? Compare two numbers. Open the router admin panel and read the WAN interface IP; suppose it shows 100.83.14.6. Now open the “what is my IP” tool, which reports, say, 187.62.200.45. Two signs seal the diagnosis: (1) the two numbers differ, which already points to another NAT layer above your router; and (2) the WAN IP, 100.83.14.6, falls within 100.64.0.0 to 100.127.255.255 (the second octet, 83, is between 64 and 127), i.e., it is RFC 6598 shared space. If the WAN were a routable public IP equal to what “what is my IP” shows, you would have an address of your own. Since it is not, the provider is doing CGNAT, and no port forwarding on your router fixes it, because the translation that matters happens above you.

What an IP really reveals about you

We reach the most common fear: “so anyone can find where I live from my IP?”. No. IP geolocation does not read a GPS; it queries a database that maps address blocks to locations, and that location is the provider’s and the block’s, the ASN (autonomous system number) and the registered allocation, not your street. An entire block of your provider may be mapped to a city center or the ISP’s headquarters, hundreds of kilometers from where you are. CGNAT and VPN make the imprecision worse: your exit appears at the provider’s PoP (point of presence) or the VPN server, not near you. The IP locator shows this estimate, treat it as an “approximate region”, never as an address.

The numbers come from MaxMind’s own accuracy documentation, an industry leader: around 99.8% correct at the country level, but only ~66% city accuracy within a 50 km radius in the US, and the company is explicit that the data is “never precise enough to identify or locate a specific household, individual, or street address”. In other words: the IP hands over country, provider and a coarse region. What actually leaks your exact location is usually something else, the EXIF metadata of a photo with GPS, for instance, points at the house with a precision no IP reaches.

• IP starting with 10, 172.16–31 or 192.168? It is private (RFC 1918), not what the internet sees.
• WAN IP in 100.64–127? You are on CGNAT: local port forwarding is useless.
• IP starting with 169.254? DHCP failed; it is a symptom, not a valid address.
• Need to expose a service at home? Confirm you have a real public IP before configuring ports.
• Worried about privacy? The IP gives country and provider, not your street, the bigger care is EXIF and logins.