DevRight now, the device you’re reading this on has an address like 192.168.1.23 — and the website serving this page has never seen it. It saw a completely different address instead. Both are “your IP address”, on two different networks, and confusing them is the root of a hundred failed port-forwarding attempts and pointless support calls. This guide separates the two: what each is for, how the translation between them works, and how to find whichever one you need. For the public one, our What’s My IP tool shows it in one click.
The two-network reality
Your home or office runs a private network. The router assigns each device an address that is only meaningful inside it — your laptop’s 192.168.1.23 reaches your printer and nothing on the internet, and millions of other homes use the very same address with no conflict, because these addresses never leave the building.
The network as a whole also has a public address, assigned by your ISP to the router’s internet-facing side. That is the address every website, mail server and game lobby sees for all your devices collectively. When a support page says “your IP address”, it means this one.
Three blocks are reserved for private use (RFC 1918):
| Range | CIDR | Size | Where you’ll meet it |
|---|---|---|---|
| 10.0.0.0 – 10.255.255.255 | 10.0.0.0/8 | 16.7 million | Large companies, VPNs, cloud VPCs |
| 172.16.0.0 – 172.31.255.255 | 172.16.0.0/12 | 1 million | Docker’s default bridge, offices, cloud |
| 192.168.0.0 – 192.168.255.255 | 192.168.0.0/16 | 65,536 | Almost every home router |
(The /8, /12, /16 notation is CIDR — our beginner’s guide to CIDR unpacks it.) Three more special ranges matter in practice: 127.0.0.0/8 is loopback (the device talking to itself; 127.0.0.1 is “me”), 169.254.0.0/16 is link-local (self-assigned when DHCP fails — seeing one means “I couldn’t get a real address”), and 100.64.0.0/10 is shared address space used by carrier-grade NAT, of which more below.
NAT: the translator in the middle
The bridge between the two worlds is Network Address Translation in your router. When your laptop (192.168.1.23) requests a web page, the router rewrites the request’s source to its own public address, remembers the swap in a table, and rewrites the reply back on its return. Consequences worth internalising:
- Outbound just works; inbound doesn’t. A device on the internet cannot start a conversation with your laptop — there’s no table entry and no public address to aim at. That’s why hosting anything at home needs port forwarding (a manual table entry: “port 8443 on the public address means the NAS at 192.168.1.50”) or a tunnel/reverse connection.
- The public address is shared. Everyone behind the router presents the same one. A housemate’s forum ban is your forum ban; a website’s “you’ve already voted” may mean a colleague did.
- It changes. Most residential ISPs assign public addresses dynamically — it may differ after a router reboot. (Business connections and some ISPs offer a static address, often paid.)
Carrier-grade NAT: when even the “public” address isn’t
IPv4 ran out of unallocated addresses years ago, so many ISPs — especially mobile carriers and newer fibre providers — put another NAT layer in the network. Your router’s “WAN address” is then a 100.64.x.x shared address, and your truly public address belongs to the ISP’s gateway, shared with hundreds of other customers. Signs you’re behind CGNAT: the WAN address in your router’s admin page starts with 100.64–100.127 and doesn’t match what What’s My IP reports. Port forwarding cannot work through CGNAT (you don’t control the outer NAT) — the usual escapes are a static-IP add-on from the ISP, a VPN with port forwarding, or a tunnel service.
Finding each address
- Public: any “what’s my IP” service — ours also shows the approximate location, ISP and the range classification, and explains exactly what that lookup involves.
- Private, on the device: Windows
ipconfig, macOS/Linuxifconfigorip addr— look for the192.168…,10…or172.16–31…address on your active interface. Our IP tool’s WebRTC section also lists the addresses your browser can see, which is the same list. - Private, from the router: the router’s admin page client list shows every device it has handed an address to — the authoritative view when you’re hunting “what is the thing at .47?”.
Does it matter which one a website sees?
For privacy, understand what’s exposed: every site you visit learns your public address (unavoidable — it has to know where to send the reply), and with it a rough location. Your private addresses stay home; a page can only learn them if the browser volunteers them, which is why modern browsers mask local addresses in WebRTC. Neither address is a precise identity: public addresses are shared and rotate, private ones are identical across millions of homes.
IPv6, finally, dissolves the distinction: addresses are plentiful, so each device typically gets a globally routable public address of its own (plus a private-style fd00::/8 unique-local address for internal use). NAT becomes unnecessary, and the firewall — not address scarcity — is what keeps inbound traffic out. Until your connection is IPv6-first, though, the two-address world above is the one to debug in.