Private and public IP addresses, and why they differ

Your laptop says its address is 192.168.1.24. This site says your address is something completely different. Both are correct, and understanding why resolves a surprising number of “why can’t I reach it” problems.

Two addresses, two jobs

The address on your laptop identifies it inside your own network. Your router hands it out, it means nothing beyond your front door, and the identical address is in use in millions of other homes and offices at this moment.

The address this site sees identifies your router to the internet. It is unique, your ISP assigns it, and everything behind that router — laptop, phone, television, printer — appears to the outside world as that single address.

The translation between the two is NAT, network address translation. Your router rewrites the source address of outgoing packets to its own public address, remembers which internal device sent it, and rewrites replies back on the way in.

The private ranges

Three ranges are reserved for private use and are never routed on the public internet:

Two more are worth recognising:

• 169.254.x.x means the device asked for an address and got no answer. It assigned itself one. This is not a configuration — it is the symptom of a DHCP failure, usually a cable, a wifi association problem, or a dead router. If you see it, that is your fault to fix and no amount of DNS checking will help.
• 127.0.0.1 is this machine, always, on every machine. It never leaves the device.

For IPv6 the equivalent private range begins fd, and fe80:: is the link-local range corresponding to 169.254.x.x.

You can check which category any address falls into with the IP lookup tool.

What this explains

Why a website cannot see your internal network. A site receives your public address and nothing else. It has no route to 192.168.1.24, because that address is ambiguous — millions of machines have it. Browsers additionally block pages from probing local addresses, and hide your local IP from WebRTC behind a random name. This is a deliberate protection and a good one. Any site claiming to show your internal layout is guessing or asking you to disable that protection.

Why port forwarding exists. Someone connecting from outside reaches your router’s public address. The router has no idea which internal device they meant, so unless you have told it “traffic on port 8080 goes to 192.168.1.50”, it drops the connection.

Why your address changes. Most residential ISPs assign a public address dynamically. It usually survives a reboot but is not guaranteed to. If something needs to reach you at a stable address, that is what dynamic DNS services are for.

Why several of you appear as one address. Everyone in the building shares the public address. Rate limits, bans and geolocation all apply to the whole group. This is also why a site sometimes asks you to prove you are human for no apparent reason — someone else behind the same address was behaving badly.

Why CGNAT breaks port forwarding. Some ISPs place customers behind a further layer of NAT, so even your router has a private address, in the range 100.64.0.0 – 100.127.255.255. If the address in your router’s admin page starts with 100.64 through 100.127, incoming connections cannot be made to work from your side at all — you need the ISP to give you a real public address.

Finding each one

Your public address is at the top of this site’s home page. Your private address you have to ask the machine:

ipconfig getifaddr en0          # macOS, wifi
ip -4 addr show                 # Linux
ipconfig                        # Windows, read "IPv4 Address"

Your router’s address — the way into its admin page — is your default gateway:

netstat -rn | grep default      # macOS
ip route | grep default         # Linux
ipconfig | findstr Gateway      # Windows

These and the rest are collected on the local checks page, with what to look for in each result.

A quick diagnosis from the address alone

Before anything else, look at what your machine has:

• 169.254.x.x — no DHCP. Check the physical connection and the router. Nothing beyond this matters yet.
• A private address, and the gateway responds to ping — local network is fine. The problem is further out; start at reading traceroute.
• A private address, gateway does not respond — the problem is between you and the router.
• A public address directly on the machine — you are not behind NAT. This is normal for a server, unusual for a laptop, and means the machine is directly exposed and should have a firewall.

Thirty seconds spent here often saves an hour of looking in the wrong place.