The Need for Private IPv4 Addressing

What it is

Private IPv4 addresses let many organisations reuse the same ranges inside their own networks and save scarce public addresses.

IPv4 has about 4.3 billion addresses in total. That sounded like plenty when the protocol was designed, but it is not enough for every phone, laptop, server and sensor in the world to have its own unique public address. The shortage is called IPv4 address exhaustion.

Private IPv4 addresses are the main way networks cope. They are ranges set aside for use inside an organisation.

Many different organisations can use the same private ranges at the same time, because these addresses are never routed across the public internet.

How it works

Private hosts use reserved ranges inside, and a translation device gives them a public address on the way out.

The three private ranges

RFC 1918 defines three blocks:

Any address outside these blocks, and outside the other special ranges, is a public address. Public addresses are assigned by regional internet registries and are unique across the internet.

Why private addresses help

They save public addresses. A business with 5,000 devices does not need 5,000 public addresses. It can use private addresses inside and share a small number of public ones.

They give flexibility. An organisation can plan its internal network without asking for permission, and it can renumber without affecting anyone else.

They provide a layer of separation. Internet routers do not forward traffic to private destinations. A host with a private address cannot be reached directly from outside unless the network allows it.

This is not a replacement for a firewall, but it does reduce exposure.

How private hosts reach the internet

Private addresses cannot be used as a source on the internet, because replies would have nowhere to go. A device such as a router or firewall must translate them.

NAT (Network Address Translation) replaces the private source address with a public one on the way out, and reverses it on the way back. With PAT, many private hosts share one public address by using different port numbers.

NAT is covered in detail in the IP Services chapter.

Two networks, one address range

Because many organisations use the same private ranges, a problem appears when two networks must be joined, for example after a company merger or when two sites connect by VPN.

If both use 192.168.1.0/24, the addresses overlap and routing cannot tell them apart. The fix is to renumber one side or to translate between them with NAT.

A common prevention is to plan the internal addressing so that each site uses a different block.

Other special IPv4 ranges

Some ranges look private but have a different purpose, so be careful not to confuse them:

• 127.0.0.0/8 is loopback. A device uses it to talk to itself. 127.0.0.1 is the usual address.
• 169.254.0.0/16 is link-local (also called APIPA on some systems). A host assigns itself an address from this range when it cannot reach a DHCP server. These addresses work only on the local link.
• 224.0.0.0/4 is multicast.
• 0.0.0.0 has special meanings, such as "this host" or the default route in a routing table.

You can see how a device is addressed with show ip interface brief on a Cisco device. A router interface that uses a private address on its inside side and a public address on its outside side is the classic NAT picture.