Ravindra BagaleCourses & study guides

1. IP Addressing: IPv4, Subnets, Public and Private IPs

1.7 Public vs Private IP (RFC 1918)

In short: A public IP is globally unique and routable on the internet. A private IP is used only inside a local network (home, institute, VPC) and is not routable on the internet.

Aata ek khup important farak – public aani private IP. Ha samjla nahi tar pudhe NAT, VPC, security groups sagla gondhalat padel.

A public IP is globally unique and routable on the internet. A private IP is used only inside a local network (home, institute, VPC) and is not routable on the internet. RFC 1918 reserves three private ranges:

Class Private range (RFC 1918) CIDR Typical use
A 10.0.0.0 – 10.255.255.255 10.0.0.0/8 Large companies, AWS VPCs
B 172.16.0.0 – 172.31.255.255 172.16.0.0/12 AWS default VPC uses 172.31.0.0/16
C 192.168.0.0 – 192.168.255.255 192.168.0.0/16 Home Wi-Fi routers

Other special ranges: 100.64.0.0/10 (carrier-grade NAT used by mobile ISPs) and 169.254.0.0/16 (link-local; on EC2, 169.254.169.254 is the instance metadata service).

Check your own IPs:

# Private IP(s) of this machine
ip -4 addr show
hostname -I

# Public IP as seen by the internet
curl -s https://checkip.amazonaws.com

Why this matters for security

Private addresses are not routable on the internet, so a database with only a private IP cannot be reached directly from outside – a strong first layer of defence. But "private" is not "secure": anyone who gets inside the network (a compromised server, a malicious insider, a VPN user) can still reach it. That is why we still use security groups, strong passwords and least privilege inside the network. Also remember 169.254.169.254 – the EC2 metadata address is a favourite SSRF target (Part 11).

Ravindra Bagale's Tip

Is 172.32.1.1 private? Many students say "it starts with 172, so it's private" – wrong! The private range is only 172.16.0.0 to 172.31.255.255. Remember the ranges: 10/8, 172.16/12, 192.168/16. Everything outside these three is public.

Practice task

Which of these are private: 10.10.10.10, 172.32.1.1, 192.168.100.1, 100.64.1.1, 8.8.8.8? Then run curl -s https://checkip.amazonaws.com and compare it with your laptop IP.