RFC 1918 Private IP Address Ranges Explained for Network+

RFC 1918 defines the three ranges of IPv4 addresses reserved for private networks. Every home router, every corporate LAN, and every cloud VPC draws from them, and they are among the few things on a networking exam worth memorizing digit for digit.

Private addresses are free, reusable by everyone, and never routed on the public internet.

The Three Ranges

Range	CIDR	Addresses	Old class	Typical use
10.0.0.0 – 10.255.255.255	10.0.0.0/8	16,777,216	One class A	Large enterprises, cloud VPCs
172.16.0.0 – 172.31.255.255	172.16.0.0/12	1,048,576	16 class Bs	Medium networks, Docker defaults
192.168.0.0 – 192.168.255.255	192.168.0.0/16	65,536	256 class Cs	Home and small office

The 172.16.0.0/12 range is the one people get wrong, so it is worth a moment. It runs from 172.16.0.0 to 172.31.255.255 — sixteen contiguous /16 blocks. Addresses such as 172.15.x.x and 172.32.x.x are public, and exam questions exploit that boundary deliberately. If you see a 172 address, check the second octet against 16–31 before answering.

Why They Exist

IPv4 has about 4.3 billion addresses, which sounded generous in 1981 and stopped being so by the early 1990s. RFC 1918, published in 1996, was part of the response: if internal devices do not need globally unique addresses, they should not consume them.

The arrangement works because private addresses are not globally unique and not routable on the internet. Internet routers are configured to drop them — a packet with a 192.168.1.1 destination goes nowhere across the public network. Millions of organizations use 192.168.1.0/24 simultaneously with no conflict, because those addresses never meet.

How Private Hosts Reach the Internet

Through NAT — Network Address Translation — usually the variant called PAT (Port Address Translation), or overloading, or simply "NAT" in casual use. The router rewrites the private source address to its own public address and tracks the translation by port number, so hundreds of internal hosts share one public IP.

This is why a private address and NAT almost always appear in the same exam question, and why NAT is frequently described as a security benefit. It is a side effect rather than a design goal: hosts behind NAT are not directly reachable from outside, but NAT is not a firewall and provides no inspection, no policy, and no logging of consequence.

Other Reserved Ranges Worth Knowing

• 169.254.0.0/16 — APIPA / link-local. Self-assigned when DHCP fails. Seeing a 169.254 address is diagnostic: the client could not reach a DHCP server.
• 127.0.0.0/8 — loopback. The whole /8, not just 127.0.0.1.
• 100.64.0.0/10 — carrier-grade NAT (RFC 6598). Used by ISPs between the customer and their public address, and increasingly common.
• 224.0.0.0/4 — multicast.
• 0.0.0.0/8 — "this network", and 0.0.0.0 as the default route or "any address".
• 255.255.255.255 — limited broadcast.

APIPA is the one most likely to appear in a troubleshooting scenario, because it has a single unambiguous meaning.

Practical Design Consequences

Because the ranges are free, teams treat them carelessly, and that causes two recurring problems.

Overlapping address space. Two companies merge, both using 10.0.0.0/16, and the networks cannot be joined without re-addressing one side or resorting to NAT between them. The same problem breaks VPC peering and site-to-site VPNs. Pick an unusual block — 10.47.0.0/16 rather than 10.0.0.0/16 — and future integration gets far easier.

Home VPN collisions. If the corporate network uses 192.168.1.0/24 and so does the employee's home router, their VPN routing breaks. This is a genuine argument for using the 10.x space for corporate LANs.

IPv6

IPv6 has no equivalent need for NAT, since the address space is not scarce. Its analogue to private addressing is unique local addresses (ULA) in fc00::/7, in practice fd00::/8, and link-local addresses in fe80::/10, which every IPv6 interface has automatically.

Network+ (N10-009) Exam Tips

• Memorize all three ranges exactly, including the 172.16–172.31 boundary.
• Identify whether an address is public or private on sight. A very likely question type.
• Private addresses require NAT to reach the internet.
• 169.254.x.x means DHCP failed. Near-certain troubleshooting question.
• Know the other reserved ranges: loopback, multicast, CGNAT, broadcast.
• Overlapping private ranges break VPNs and peering — the practical consequence exams like.
• ULA fc00::/7 and link-local fe80::/10 for IPv6.

Security+ and A+ Angles

Security+ (SY0-701) covers NAT as obscurity rather than security, private addressing as part of segmentation design, and the fact that internal addresses leaking in headers or error messages is an information disclosure issue.

A+ (220-1201/1202) keeps it practical: recognizing a private address in ipconfig output, understanding that the router does the translation, and identifying an APIPA address as a DHCP problem.

Key Takeaways

• The three private ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
• 172.16 through 172.31 only — 172.15 and 172.32 are public.
• They are not routable on the internet, which is what lets everyone reuse them.
• NAT or PAT translates them to a public address for internet access.
• 169.254.x.x is APIPA and means the DHCP server could not be reached.
• Choose an unusual block to avoid the overlap problems that break VPNs and mergers.