Public IP vs Private IP
Two kinds of address, two very different jobs. Mixing them up is the most common mistake in networking.
The short version
Your device has a private address that only means something inside your own network. Your household or office shares one public address out on the internet. Both are real, both are correct, and they answer different questions.
When something asks for "your IP address," it almost always wants the public one, which is the number at the top of our front page. If the number you are looking at starts with 192.168., 10., or 172.16. through 172.31., that is the private one and it will not work.
Why you have two at all
There are only about 4.3 billion IPv4 addresses and far more than 4.3 billion connected devices. Handing every phone, laptop, thermostat and doorbell its own public address stopped being possible long ago.
The workaround is to reuse the same private ranges in every network on earth. Your neighbor almost certainly has a device on 192.168.1.14 as well. That is fine, because those addresses never leave either of your homes. Your router translates between the private world inside and the public one outside.
How NAT keeps replies straight
This is the part that sounds impossible until you see it. If three devices share one public address, and three replies come back to that address, how does the router know which reply belongs to which device?
The answer is ports. Every connection has a source port as well as an address, and the router is free to change it. When your phone opens a connection, the router picks an unused port on the public side, rewrites the packet to use it, and writes the pairing into a table.
This is called Network Address Translation, and it is the single most consequential workaround in the history of the internet. It was meant to buy time while IPv6 arrived. It worked so well that it became permanent infrastructure.
An unsolicited connection from outside has no matching entry in the translation table, so the router has nowhere to send it and drops it. That is a side effect of the design rather than a security feature, and it is why plugging a device straight into a modem with no router in between is a genuinely different risk. Do not rely on it as your only protection, but do understand that removing NAT removes it.
Every range that is not public
Three IPv4 ranges are reserved for private networks by RFC 1918. A handful of others are special in their own way, and recognizing them saves real time.
10.0.0.0 to 10.255.255.255 16,777,216 addresses. Businesses, data centers, VPNs. 172.16.0.0 to 172.31.255.255 1,048,576 addresses. Very common inside containers. 192.168.0.0 to 192.168.255.255 65,536 addresses. The default on most home routers.
| If you see | It is | What that tells you |
|---|---|---|
192.168.x.x | Private | A home or small office network |
10.x.x.x | Private | A larger network, a workplace, or a VPN tunnel |
172.16 to 172.31 | Private | Often Docker or another container runtime |
100.64 to 100.127 | Carrier-grade NAT | Your provider is sharing one public address among many customers. More on this |
127.x.x.x | Loopback | The machine talking to itself. Traffic never reaches the network |
169.254.x.x | Link-local | A failure signal. The device asked for an address and nothing answered |
fe80:: | IPv6 link-local | Normal. Every IPv6 interface has one, and it is not routable |
That range is what a device assigns itself when no DHCP server replies. Seeing it usually means an unplugged cable, a Wi-Fi association that did not complete, or a router that is not handing out addresses. The address is the device improvising after being ignored.
When the difference actually bites
Someone needs to reach a device in your house
A security camera, a game server, a home media library. The outside world can only address your public IP, so the router needs a rule saying which inside device gets traffic on a given port. That is port forwarding, and it works only if your public address really is yours. Under carrier-grade NAT it cannot work at all, because the second translation happens on equipment you do not control.
A vendor asks for your IP for an allowlist
Give them the public one. Then read why your IP changes before you rely on it, because a residential address can move and the failure will look like a permissions bug rather than an address change.
You are checking whether a VPN is working
A working VPN changes your public address to the VPN server's. Your private address does not change, because your local network has not moved. If the address on our front page still looks like your own provider, the tunnel is not carrying that traffic.
You need to find a device on your own network
Use the private address. A printer at 192.168.1.50 is reachable from your laptop and from nowhere else on earth, which is exactly what you want.
Does IPv6 end all this?
In principle, yes. IPv6 has so many addresses that every device can hold a globally routable one, with no translation layer and no shared exit. Connections become genuinely end to end again, which is how the internet was originally designed to work.
In practice, plenty of networks still translate IPv6 for policy reasons, and the accidental privacy of hiding behind one shared address turns out to be something people liked. The more important change is that the firewall now has to do the job NAT was doing by accident, and it has to be configured deliberately rather than inherited for free.