Private IPv4 Ranges (RFC 1918)
Three ranges, defined by RFC 1918, reserved for internal use and never routed on the public internet.
The three ranges
| Range | First address | Last address | Addresses | Historic class |
|---|---|---|---|---|
| 10.0.0.0/8 | 10.0.0.0 | 10.255.255.255 | 16,777,216 | one class A |
| 172.16.0.0/12 | 172.16.0.0 | 172.31.255.255 | 1,048,576 | 16 class Bs |
| 192.168.0.0/16 | 192.168.0.0 | 192.168.255.255 | 65,536 | 256 class Cs |
Total: 17,891,328 addresses.
The boundary that catches people is the middle one. 172.16.0.0/12 covers 172.16 through 172.31 only. 172.32.0.0 is public space belonging to a real organisation, and filtering or NATing it as though it were private breaks reachability to whoever holds it.
Ranges that are not RFC 1918 but behave similarly
These get called “private” in conversation and are not. The distinction matters when you pick internal space.
| Range | RFC | Purpose |
|---|---|---|
| 100.64.0.0/10 | 6598 | Shared address space for carrier-grade NAT between a provider and its subscribers |
| 169.254.0.0/16 | 3927 | Link-local, self-assigned when DHCP fails; never forwarded by a router |
| 127.0.0.0/8 | 1122 | Loopback |
| 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 | 5737 | Documentation and examples |
| 198.18.0.0/15 | 2544 | Benchmark testing between devices |
Do not use 100.64.0.0/10 as general internal space. It is reserved for the segment between a provider’s CGNAT and its subscribers. If you use it internally and your upstream also uses it, you get an address collision you cannot fix from your side. Details in CGNAT.
The full picture of what does and does not route is in reserved and bogon ranges.
Choosing internal space without creating future work
Private space is abundant, which is exactly why it gets allocated carelessly. Two decisions cause most of the pain later.
Do not start at 10.0.0.0/24 or 192.168.1.0/24. Every default configuration in existence uses those. The first time you connect a partner network, run a VPN, or acquire a company, you collide. Pick a range that is unlikely to be someone else’s default — a randomly chosen /16 inside 10.0.0.0/8 costs nothing and avoids most collisions.
Allocate from 10.0.0.0/8 with structure, not sequentially. The block is large enough to encode meaning: a /16 per region or site, a /20 per function inside it. Sequential allocation from the bottom produces a plan that cannot summarise and cannot grow. The method is covered in address plan design.
Record it. Private space feels free, so assignments get made verbally and never written down. That is how two teams end up on the same /24 and discover it during a merge. See what is IPAM.
When private space is not the answer
RFC 1918 space solves internal addressing. It does not solve anything that needs to be reachable from the internet:
- Public-facing services need a routable address, and one per TLS endpoint that cannot share SNI.
- Mail servers need a public address with consistent forward and reverse DNS, and a reputation history attached to it.
- Anything a customer allowlists by address needs an address that will not change.
At that point the choice is between NAT with its port and logging costs, and acquiring routable space. IPv4 services covers the second option.
Related
- Reserved and bogon ranges — the full list of what never routes
- CGNAT — why 100.64.0.0/10 exists and what it costs
- CIDR chart — prefix sizes referenced above
- Subnet calculator — split a private block into subnets