IP addresses

Public vs private IP address

Your devices have two kinds of address: a private one inside your home and a shared public one on the internet. Knowing which is which explains port forwarding, remote access and CGNAT.

Updated By the SpeedTester.pk team

Short answerA public IP address is unique on the internet and is how websites see your connection; your ISP assigns it to your router. A private IP address is used only inside your local network (like 192.168.1.23) and can't be reached from the internet. The router translates between them using NAT.

Public vs private IP checker

Check whether an IP address is public, private, CGNAT, loopback or reserved.

Open public vs private IP checker

The private address ranges

Three IPv4 ranges are reserved for private networks (RFC 1918), plus one for ISPs' shared NAT:

RangeCIDRTypically used by
10.0.0.0 – 10.255.255.25510.0.0.0/8Offices, some ISP gateways, mobile networks
172.16.0.0 – 172.31.255.255172.16.0.0/12Business networks, containers
192.168.0.0 – 192.168.255.255192.168.0.0/16Almost all home routers
100.64.0.0 – 100.127.255.255100.64.0.0/10Carrier-grade NAT (shared by ISPs, RFC 6598)

In short: Anything else (except a few special ranges) is public. Check any address with the public vs private IP checker.

How NAT connects them

When your laptop (192.168.1.23) opens a website, the router rewrites the request so it comes from the router's public IP, remembers which device asked, and forwards the reply back to it. Dozens of devices can share one public address this way.

The catch is that connections have to start from inside. A request arriving from the internet has no matching entry, so the router drops it. That's good for security, but it's why hosting a game server or reaching a home camera remotely needs port forwarding.

CGNAT: when your ISP adds another layer

Public IPv4 addresses are scarce, so many ISPs, and nearly all mobile networks, put customers behind carrier-grade NAT. Your router gets a private-range address from the ISP, and the ISP translates many customers to a smaller pool of public addresses.

Everyday browsing, streaming and gaming work normally. What breaks is anything that needs incoming connections: port forwarding, hosting servers, some peer-to-peer apps and remote access to cameras or NAS drives without a cloud service. Some online games may also show a strict NAT type.

  1. Open your router's status page and note the WAN / Internet IP address (router login).
  2. Check your public IP with What is my IP.
  3. If they differ, or the WAN address is in 100.64.x.x–100.127.x.x or 10.x.x.x, you're behind CGNAT.

Port forwarding and remote access

With a public IP, port forwarding sends incoming connections on a chosen port to one device at home. You can confirm it works with the port checker. Behind CGNAT, forwarding on your router has no effect. The options are asking your ISP for a public IP, using IPv6 if your ISP provides it, or using a relay or tunnel service.

What about IPv6?

IPv6 has so many addresses that devices can each get a public, globally unique address, and NAT is usually unnecessary. Your router's firewall still blocks unsolicited incoming traffic by default. If your ISP supports IPv6, CGNAT affects only your IPv4 traffic. Check with the IPv6 test.

Common questions

Is 192.168.1.1 a public or private IP?

Private. Everything from 192.168.0.0 to 192.168.255.255 is reserved for local networks and can't be reached from the internet.

How do I know if I'm behind CGNAT?

Compare the WAN/internet address on your router's status page with the address shown on our What is my IP tool. If they differ, or the router's address is in 100.64.0.0–100.127.255.255 or another private range, your ISP is using carrier-grade NAT.

Is having a private IP safer?

It adds a layer of protection because unsolicited connections from the internet can't reach private addresses directly. It isn't a substitute for updates, strong passwords and a router firewall.

Can I get a public IP from my ISP?

Many ISPs offer a public or static IP on request, sometimes for a monthly fee. Ask for a “public IP” (not behind CGNAT) if you need port forwarding, remote access or hosting.

Run a speed test