Not every IP address is meant for the public internet. Some ranges are reserved for private networks, some for loopback, some for documentation, and one for ISPs’ carrier-grade NAT. Knowing them helps you read configs, design VPN and Docker networks, and spot misconfigurations, such as a service bound to a private IP that you expected to be public.

The private IPv4 ranges (RFC 1918)

Range CIDR Addresses Common use
10.0.0.0 – 10.255.255.255 10.0.0.0/8 16.7 million Corporate networks, cloud VPCs, VPNs
172.16.0.0 – 172.31.255.255 172.16.0.0/12 1 million Docker’s default bridges (172.17+), some VPCs
192.168.0.0 – 192.168.255.255 192.168.0.0/16 65,536 Home and small-office routers

These addresses:

  • aren’t routed on the public internet. Packets from or to them are dropped by internet routers;
  • can be reused by every organisation independently;
  • reach the internet through NAT. See NAT explained.

Note that 172.16.0.0/12 covers 172.16 through 172.31. An address like 172.32.1.1 is public.

Other special IPv4 ranges

Range Purpose
127.0.0.0/8 Loopback: the machine itself (127.0.0.1 = localhost)
0.0.0.0/8 “This network”; 0.0.0.0 as a listen address means all interfaces
169.254.0.0/16 Link-local: self-assigned when DHCP fails. Cloud metadata services use 169.254.169.254
100.64.0.0/10 Shared address space for carrier-grade NAT. Also used by Tailscale
192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 Documentation examples (TEST-NET), never real hosts
224.0.0.0/4 Multicast
240.0.0.0/4 Reserved
255.255.255.255 Limited broadcast

The documentation ranges are why tutorials, including this blog, use addresses like 203.0.113.10. They’re guaranteed not to belong to anyone.

IPv6 equivalents

Range Purpose
::1/128 Loopback
fe80::/10 Link-local (on every interface)
fc00::/7 (fd00::/8 in practice) Unique local addresses: private IPv6
2001:db8::/32 Documentation
::/0 Default route / any address

See IPv4 vs IPv6.

Private IPs on a VPS

A VPS usually has:

  • a public IPv4 on its main interface. With VPS.DO, the IP is assigned directly to the server, with no NAT in front;
  • 127.0.0.1 for local services;
  • possibly private addresses you add yourself: a WireGuard network (10.8.0.0/24), Docker bridges (172.17.0.0/16 and up) or a private interconnect.

Check what you have:

ip -br addr

Bind internal services to private or loopback addresses

Databases, Redis, admin panels and internal APIs should listen on 127.0.0.1 or a private address, never on 0.0.0.0 (all interfaces), unless firewalled:

sudo ss -tlnp | grep -vE '127\.0\.0\.1|::1'    # what's listening beyond loopback?

See check open ports.

Choosing subnets that don’t collide

Overlapping ranges cause routing confusion: your VPN can’t reach the office network if both use 192.168.1.0/24. Tips:

  • Avoid 192.168.0.0/24 and 192.168.1.0/24 for VPNs. Nearly every home router uses them, so remote users would collide.
  • Pick something unusual inside 10.0.0.0/8, such as 10.77.12.0/24 for a VPN or 10.42.0.0/16 for container networks.
  • Docker allocates 172.17.0.0/16 and following ranges for bridges, plus more for Compose networks. If that clashes with a company or VPN range, set default-address-pools in /etc/docker/daemon.json:
{
  "default-address-pools": [ { "base": "10.210.0.0/16", "size": 24 } ]
}
  • Write down every range in use: VPN, Docker, cloud private networks, office.

See subnetting and CIDR and Docker networking.

Security notes

  • Firewall rules for private ranges are useful (allow 10.0.0.0/8 to reach a database), but make sure those ranges are really yours on that interface.
  • SSRF protection: applications that fetch URLs on behalf of users (webhooks, image fetchers) should block private, loopback and link-local destinations, including 169.254.169.254. Otherwise attackers can reach internal services.
  • Spoofed private sources arriving on a public interface should be dropped. Reverse path filtering (rp_filter) helps. See sysctl tuning.

Quick reference

Need Range
Home or office LAN 192.168.0.0/16
VPN, internal networks 10.0.0.0/8 (pick an uncommon /24)
Containers 172.16.0.0/12 (Docker default)
Localhost 127.0.0.1 / ::1
Private IPv6 fd00::/8
Docs and examples 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24

Related: WireGuard VPN and NAT explained.

  • Networking
  • IPv4
  • Basics