A public IP address can be routed across the internet, while a private IP address is used within private networks. In IPv4 networks, NAT connects those address spaces, while a proxy creates a separate connection whose public egress is visible to the destination.
What Is the Difference Between a Public and Private IP Address?
Public IPv4 addresses are globally coordinated and can be routed across the internet, whereas private addresses come from reserved ranges and remain within their local networks.
Separate networks can reuse the same private address, although overlapping ranges require an addressing plan when those networks are connected. On most home and office networks, a router translates private IPv4 traffic toward a public egress.
Public vs Private IP Addresses at a Glance
This comparison covers IPv4 because IPv6 uses different global and local address types.
| Characteristic | Public IPv4 | Private IPv4 |
|---|---|---|
| Scope | Public internet | Private network |
| Routing | Routable when its prefix is announced | Not routed on the public internet |
| Assignment | Coordinated globally | Assigned locally from reserved ranges |
| Reuse | Coordinated to prevent conflicts | Reused by separate private networks |
| Internet access | Direct when routing and filtering permit | Usually through NAT or another intermediary |
| Destination visibility | Source address on a direct connection | Remains within the private network |
The Three Private IPv4 Ranges
RFC 1918 reserves three specific address blocks for use within private IPv4 networks:
| Characteristic | Public IPv4 | Private IPv4 |
|---|---|---|
| Scope | Public internet | Private network |
| Routing | Routable when its prefix is announced | Not routed on the public internet |
| Assignment | Coordinated globally | Assigned locally from reserved ranges |
| Reuse | Coordinated to prevent conflicts | Reused by separate private networks |
| Internet access | Direct when routing and filtering permit | Usually through NAT or another intermediary |
| Destination visibility | Source address on a direct connection | Remains within the private network |
The slash prefix records the number of leading bits that define the block. Within the frequently misstated 172.16.0.0/12 block, only addresses from 172.16.0.0 through 172.31.255.255 are private.
An address outside RFC 1918 is not automatically public because the IANA registry also contains special-purpose space. The most relevant exception for proxy networks is Shared Address Space. RFC 6598 reserves 100.64.0.0/10 for use between customer equipment and provider translation infrastructure. It can appear as a router's WAN address, but it is not a fourth private IPv4 range.
How NAT and PAT Connect Private Networks to the Internet
Network address translation changes IP addressing information between networks, while Network Address Port Translation, commonly called PAT, also translates TCP or UDP ports, allowing many private devices to share one public address through distinct port mappings.
This HTTPS example uses reserved documentation addresses rather than live endpoints:
| Connection stage | Source | Destination |
|---|---|---|
| Device sends to router | 192.168.1.24:51514 | 198.51.100.80:443 |
| Router sends to internet | 203.0.113.7:62001 | 198.51.100.80:443 |
| Server returns response | 198.51.100.80:443 | 203.0.113.7:62001 |
| Router returns response to device | 198.51.100.80:443 | 192.168.1.24:51514 |
The router maps the response at 203.0.113.7:62001 back to 192.168.1.24:51514, while other private devices receive different port mappings that let them share the public address. The destination receives 203.0.113.7 as the source rather than the client's private address.
Carrier-grade NAT adds another layer
Carrier-grade NAT adds translation inside the provider's network, where a customer's router may receive an address from 100.64.0.0/10 before multiple subscribers are translated through a public pool. This design is common on mobile networks and is also used by residential ISPs. Port forwarding on the customer's router cannot create a path through translation controlled by the provider.
NAT is not a firewall
NAT rewrites addressing information, whereas a firewall decides whether traffic is permitted. An unmatched inbound packet has no private destination in a typical PAT flow, but filtering remains a separate behavior. The IETF confirms that NAT does not provide security by itself, and port forwarding still requires an appropriate firewall policy.
How Public and Private IP Addresses Work with Proxies
A conventional external forward proxy accepts a client connection and opens a separate connection toward the destination. The destination receives the proxy's public egress as its source, while the private address assigned to the client remains unchanged. Proxy ingress and egress can use different addresses, particularly when one gateway provides access to a rotating pool.
A local proxy may receive the client's private address directly, whereas an internet proxy normally receives the public source produced by NAT or CGNAT. The destination receives the selected proxy egress, and authentication can associate the connection with a customer independently of its source.
An HTTP proxy can disclose client information through the standardized Forwarded header or the non-standard X-Forwarded-For header. Without that disclosure, the proxy's egress remains the network-layer source. For HTTPS, CONNECT can preserve TLS between the client and destination unless separate interception is configured.
Private IP address and private proxy mean different things
A private IP address belongs to a reserved internal range, whereas private proxy is a service term without a standardized definition. Providers may use it for restricted access or an egress reserved for one customer. Dedicated and shared proxies describe access rather than address scope, and the destination still receives a public proxy egress.
Where proxy IP addresses come from
Proxy categories often describe the network supplying the public egress address:
| Proxy category | Public address source |
|---|---|
| Datacenter | Hosting or datacenter infrastructure |
| ISP | ISP address space operated on datacenter infrastructure |
| Residential | Residential ISP connectivity |
| Mobile | Mobile carrier connectivity, commonly behind CGNAT |
Network origin does not determine rotation or customer access because either behavior depends on the service configuration.
Forward and reverse proxies expose different public endpoints
Unlike a forward proxy representing a client, a reverse proxy presents an inbound address for a service whose backend servers may use private addresses.
Public and Private Addressing in IPv6
IPv6 uses 128-bit addresses and does not use the private ranges defined by RFC 1918. Global unicast addresses most closely match the role of public IPv4, while local addressing follows different rules.
Every IPv6 interface uses a link-local address from fe80::/10 for functions such as neighbor discovery. Unique Local Addresses use fc00::/7, with locally generated prefixes using fd00::/8 for controlled internal routing rather than the global internet.
An interface can hold local and global IPv6 addresses simultaneously, including temporary global addresses for outbound connections. IPv6 does not require many-to-one NAT for address conservation, and a stateful firewall can restrict inbound traffic without translation. A dual-stack proxy can accept one address family and use the other for egress, as covered in our IPv4 and IPv6 proxy comparison.
Key takeaways
What to remember about public and private IP addresses
- Public IPv4 addresses support internet routing, while RFC 1918 addresses remain within private networks.
- PAT lets private devices share a public IPv4 address, but translation does not replace firewall policy.
- A forward proxy leaves the client's local address in place and presents the proxy's public egress to the destination.
- Proxy source categories do not determine whether an egress rotates or whether access to it is shared.
- IPv6 provides both global and local scopes without requiring many-to-one translation for address conservation.