Short answer: private vs public IP addresses describe two different scopes. A private IP works inside a local network, such as your home Wi-Fi, office LAN, or hotspot. A public IP is the address visible to websites and internet services outside that local network.
Most home networks use both at the same time. Your phone, laptop, TV, printer, or console gets a private address from the router. The router then uses a public address from the ISP, or sometimes a carrier-grade NAT layer, to reach the internet. Understanding that split helps you troubleshoot connection problems, port forwarding, VPN behavior, leak checks, gaming, cameras, and remote access without confusing one address type for the other.
Quick answer
- Private IP: used inside a local network and commonly starts with
192.168.,10., or172.16.through172.31.. - Public IP: used on the internet and visible to websites, apps, and external services.
- NAT: lets many private devices share one public IPv4 address, but NAT is not a replacement for a firewall or secure configuration.
- IPv6: can give devices globally routable addresses, link-local addresses, and unique local addresses, depending on the network.
- VPN: usually changes the public IP websites see, but not the local private address your router assigned to the device.
Private vs public IP addresses at a glance
| Question | Private IP address | Public IP address |
|---|---|---|
| Where it works | Inside your home, office, school, hotspot, or other local network | Across the public internet |
| Who assigns it | Your router, DHCP server, device, or network administrator | Your ISP, mobile carrier, VPN provider, hosting provider, or organization |
| Common IPv4 examples | 192.168.1.23, 10.0.0.42, 172.16.5.20 | Any globally routed public IPv4 address not reserved for private or special use |
| Can websites see it? | Usually no, not as the normal page IP | Yes, unless traffic exits through a VPN, proxy, Tor, or another gateway |
| Can it be reused? | Yes. Millions of networks can reuse the same private ranges | No. Public addresses must be globally coordinated |
| Main troubleshooting use | Finding devices, router gateway, printers, cameras, DHCP problems, local sharing | Checking ISP route, VPN route, geolocation, ASN, DNS, account-access signals |
| Main safety issue | Local device exposure, weak router admin, insecure LAN services | Open ports, exposed services, reputation, geolocation, account-risk signals |
The easiest way to remember private vs public IP addresses is scope: private is local, public is internet-facing. The two may appear together in one connection because the router sits between your local network and the wider internet.
Some browser features, especially WebRTC, can expose local or network candidate signals in certain setups. That does not mean every website normally sees your private IP as the page IP, but it is a reason to check WebRTC behavior when comparing private vs public IP addresses, VPN behavior, and browser exposure.
What is a private IP address?
A private IP address is used inside a network that you or an organization controls. The classic IPv4 private-use ranges are defined by RFC 1918:
10.0.0.0/8— addresses from10.0.0.0to10.255.255.255172.16.0.0/12— addresses from172.16.0.0to172.31.255.255192.168.0.0/16— addresses from192.168.0.0to192.168.255.255
Your router may give your laptop 192.168.1.34, your phone 192.168.1.35, and your printer 192.168.1.50. Another home down the street can use the same numbers because those addresses are meaningful only inside each local network.
Private addresses are useful for local traffic: file sharing, printer discovery, router administration, smart-home devices, NAS access, cameras, and game consoles. They are not normally reachable from the public internet unless another mechanism is added, such as port forwarding, a VPN, a cloud relay, or remote-access software.
What is a public IP address?
A public IP address is globally routable. It is the address websites and internet services see for your connection unless you use a VPN, proxy, Tor, corporate gateway, or another exit network. Public IPs are coordinated so that the same address is not assigned to unrelated networks at the same time.
For a typical home connection, the public IPv4 address is assigned to the router's WAN side by the ISP. For mobile data, it may belong to the carrier network. For a VPN session, the public IP visible to websites is usually the VPN server's exit IP, not your home router's public IP.
A public IP can reveal broad network context such as ISP, ASN, approximate location, VPN or hosting signals, and reputation. It should not be treated as a personal identity by itself. Account logins, cookies, timestamps, provider records, browser signals, and user-granted location can add more context than the public IP alone.
How NAT connects private and public IPs
Network Address Translation, or NAT, lets many private devices share one public IPv4 address. In a home network, your laptop sends traffic from a private address to the router. The router rewrites the outbound traffic so it appears to come from the router's public address and a temporary port. When the reply comes back, the router maps it to the correct private device.
RFC 3022 describes traditional NAT behavior. In practical terms, NAT is why a website usually sees one public IP for the whole household even though several devices are online at the same time.
NAT helps with IPv4 address scarcity and local addressing, but do not mistake it for a security model by itself. A firewall, router updates, strong admin credentials, careful port-forwarding rules, and secure device configuration still matter.
7 key differences that matter in real life
- Visibility: websites see the public IP; local network tools see private IPs.
- Uniqueness: public IPs must be globally coordinated; private IPs are reused across many networks.
- Assignment: public IPs come from ISPs, carriers, VPNs, hosting providers, or organizations; private IPs usually come from local DHCP.
- Troubleshooting: private IPs help fix local printers, cameras, routers, and DHCP issues; public IPs help diagnose VPN route, geolocation, ASN, DNS, and account-access issues.
- Remote access: a private IP alone is not enough for internet access to a device; remote access needs a safe path such as a private VPN, properly secured gateway, or managed service.
- Privacy interpretation: hiding or changing the public IP does not erase local private addressing, account identity, cookies, browser fingerprinting, or provider records.
- IPv6 behavior: IPv6 may reduce the need for NAT, but it still needs sensible firewalling and careful router configuration.
IPv6 private, public, and local-style addresses
IPv6 does not map perfectly onto the old private-versus-public IPv4 model. A device can have several IPv6 addresses at once, with different scopes:
- Global unicast IPv6: routable on the public internet when firewall and routing allow it. This is the closest equivalent to a public IPv6 address.
- Unique local IPv6:
fc00::/7, commonly seen asfd00::/8for locally assigned unique local IPv6 addresses. This is local-style IPv6 space, not globally routed public internet space. - Link-local IPv6:
fe80::/10, used for communication on the local link. RFC 4291 defines core IPv6 addressing architecture, including address scopes. - Temporary IPv6 addresses: some systems use temporary addresses for outbound connections to reduce long-term correlation.
If your network uses IPv6, the public/private question becomes: which IPv6 address is visible to websites, which one is only local, and whether your router firewall handles inbound traffic as expected. Do not assume IPv6 is unsafe, and do not assume NAT is required for security.
CGNAT and shared public addresses
Carrier-grade NAT, or CGNAT, adds another layer. Your router may receive an address that is not a normal public IPv4 address, while your ISP shares a smaller pool of public IPv4 addresses across many customers. RFC 6598 defines 100.64.0.0/10 as shared address space often associated with this kind of provider-side NAT.
CGNAT is common on mobile networks and some home ISPs because IPv4 addresses are limited. It can break or complicate port forwarding, self-hosting, cameras, game servers, inbound VPN, and peer-to-peer connections. If your router WAN address is in 100.64.0.0/10, 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16, but MyIPScan shows a different public IP, your ISP may be adding another NAT layer.
How to check both safely
- Open What Is My IP. This shows the public IP visible to websites for this browser session.
- Open your device network settings to find the local/private IP. On Windows, use
ipconfig. On macOS, check Network settings or usenetworksetup -listallhardwareportsandipconfig getifaddrfor the active interface. On Linux, useip addr. - Check the router admin page from your trusted local network only. Look for LAN/DHCP clients to see private addresses and WAN/Internet status to see what the router received from the ISP.
- Compare the router WAN address with MyIPScan's public IP result. If they differ, a VPN, proxy, work tunnel, mobile carrier, or CGNAT layer may be involved.
- Run ASN Lookup and IP Geolocation Lookup for context on the visible public IP.
- If you use a VPN or unusual browser profile, run DNS Leak Test, WebRTC Leak Test, and IPv6 Leak Test.
Only test networks and devices you own or are authorized to manage. You do not need to probe unrelated IP addresses to understand private vs public IP addresses.
Common mistakes to avoid
- Do not share router admin pages on the public internet. Use safer remote access patterns, such as a private VPN to a trusted network, strong authentication, and updated firmware.
- Do not assume NAT means everything is safe. NAT can hide local addresses during normal outbound IPv4 traffic, but open ports, UPnP, weak passwords, vulnerable devices, and cloud relays can still create risk.
- Do not confuse a public IP with a person. Shared Wi-Fi, VPNs, mobile networks, CGNAT, offices, and households can put many people behind one visible address.
- Do not expect private IPs to be unique globally. Seeing
192.168.1.10tells you almost nothing about which home or office it came from. - Do not disable IPv6 as a first answer. Understand whether the address is global, unique local, link-local, or temporary, then fix routing, firewall, VPN, or DNS behavior.
When private vs public IP addresses matter most
- Port forwarding or remote access does not work. The router WAN address, public IP, firewall rules, and CGNAT status may matter more than the device's private IP.
- A printer, NAS, camera, or smart TV cannot be found locally. The private IP, gateway, subnet, and router device list are usually the first things to check.
- A game console or camera cannot be reached from outside. Public IP, CGNAT, port forwarding, and safer remote-access design matter.
- A VPN changes the public IP but not the local address. The VPN route can change what websites see while the router-assigned private IP stays the same.
- IPv6 is active. Devices may have global, unique local, link-local, and temporary IPv6 addresses, so scope and firewalling matter.
What to do next
If you are troubleshooting a normal home network, start with the router: check DHCP leases, the default gateway, and the WAN address. If you are troubleshooting what websites see, start with the public IP and ASN. If you are troubleshooting VPN behavior, compare the public IP, DNS, WebRTC, and IPv6 results before and after connecting.
The practical value of understanding private vs public IP addresses is knowing which layer you are looking at. Local printer issue? Private IP. Website thinks you are in another city? Public IP and geolocation. Port forwarding does not work? Router WAN, CGNAT, firewall, and ISP policy. VPN route looks strange? Public IP, DNS, WebRTC, and IPv6 together.
Frequently asked questions
What is the difference between a private IP and a public IP?
A private IP works inside a local network, such as a home, office, or Wi-Fi network. A public IP is the address visible to websites and internet services. Routers often use NAT so several private devices can share one public IPv4 address.
Can the internet connect directly to my private IP address?
Usually, no. Private IPv4 addresses are not routed across the public internet. Remote access normally needs a public IP, port forwarding, VPN, cloud relay, or another gateway, and those setups should be secured carefully.
How do I check my public IP and private IP?
Use What Is My IP to see the public IP visible to websites. Use your device network settings, ipconfig, ifconfig, ip addr, or your router DHCP list to find the private IP used inside your local network.
Is CGNAT the same as a private IP address?
Not exactly. CGNAT means your ISP may place your router behind another shared address layer, often using 100.64.0.0/10 shared address space. Your home devices can still use private addresses behind your router.
Does a VPN change my private IP address?
A VPN usually changes the public IP websites see by routing traffic through a VPN server. It usually does not change the local private IP assigned by your router, although the VPN app may add a separate tunnel interface address.
Sources and methodology
MyIPScan tools and examples show observable browser and network signals. IP and geolocation results can be approximate, and VPN, DNS, WebRTC, IPv6, ASN, reputation, and browser checks are snapshots. A single result does not prove anonymity or every security condition. See the MyIPScan methodology and editorial policy.
This FAQ was updated using MyIPScan editorial guardrails: clear private/public scope definitions, no IP-based identity overclaims, no VPN anonymity claims, no unsafe scanning advice, and primary technical sources for private IPv4, IPv6 local-style addressing, CGNAT shared address space, and NAT behavior.