Guide
Private, CGNAT, and public IPv4 addresses
Identify RFC 1918 addresses and the shared CGNAT range, avoid mixing them up, and check other special-purpose IPv4 blocks.
by Tools in a Tab · Published on · Reviewed on
Short answer
An IPv4 address is private when it belongs to 10.0.0.0/8, 172.16.0.0/12,
or 192.168.0.0/16. The 100.64.0.0/10 block is shared address space for
CGNAT: it is neither RFC 1918 private space nor publicly routable space. An
address outside those four blocks can still be special, so check IANA before
calling it public.
Commonly confused ranges
| Type | Range | Example | Typical use |
|---|---|---|---|
| Private | 10.0.0.0/8 |
10.20.30.40 |
Internal network |
| Private | 172.16.0.0/12 |
172.20.1.5 |
Internal network |
| Private | 192.168.0.0/16 |
192.168.1.10 |
Home network |
| Shared CGNAT | 100.64.0.0/10 |
100.72.8.9 |
Customer-to-provider link |
The three private ranges are reserved by
RFC 1918. RFC 6598
reserves 100.64/10 so providers can share a public IPv4 address among several
customers. Do not treat that block as general-purpose private space or expect
it to be routed across the Internet.
How to recognize CGNAT
If your router’s WAN interface receives 100.88.12.4, for example, while an
external site observes another IPv4 address, there is probably provider NAT in
addition to your home NAT. Incoming connections can then fail even after you
forward a port on your router.
An address in 100.64/10 is a strong signal, not the only possible test. Some
providers use different designs. Compare the WAN and externally observed
addresses, then ask the provider if inbound reachability matters.
“Not private” does not always mean public
IPv4 also contains loopback, link-local, documentation, multicast, and other
special-purpose ranges. For example, 127.0.0.1 is not RFC 1918 private, but it
is not public either. The IANA IPv4 Special-Purpose Address Registry
is the authoritative classification reference.
The IPv4 subnet calculator finds network, broadcast, and host ranges for a prefix. Those results describe the subnet; they do not guarantee that the address block is globally routable.
Quick check
- Test whether the address falls in one of the three RFC 1918 blocks.
- If it lies from
100.64.0.0through100.127.255.255, classify it as CGNAT shared space. - Otherwise consult IANA to rule out another special use.
- Only then call an address public and globally routable.
Keeping address type separate from subnet arithmetic prevents incorrect diagnoses about NAT, port forwarding, and Internet reachability.