Private and special IP ranges
Distinguish private, shared, loopback, and link-local addresses. Interpret IPv4 WAN comparisons separately from IPv6.
PPORT ·
Quick start
- Identify IPv4 or IPv6.
- Find the address category.
- Review NAT, routing, and firewall rules.
Private IPv4 ranges
| CIDR | Range |
|---|---|
| 10.0.0.0/8 | 10.0.0.0–10.255.255.255 |
| 172.16.0.0/12 | 172.16.0.0–172.31.255.255 |
| 192.168.0.0/16 | 192.168.0.0–192.168.255.255 |
Other special addresses
| Range | Meaning |
|---|---|
| 100.64.0.0/10 | Shared address space, separate from RFC1918 |
| 127.0.0.0/8 | Loopback |
| 169.254.0.0/16 | Link-local; not proof of DHCP failure by itself |
| 0.0.0.0 | May mean all local IPv4 interfaces when binding a socket; not an internet destination |
| 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 | Documentation |
| 224.0.0.0/4 | Multicast |
Different WAN and public addresses
Compare the same address family and route. Private or shared WAN IPv4 space can indicate upstream NAT. An external site usually sees the translated exit address; CGNAT does not mean the page must show 100.64.x.x.
IPv6
fc00::/7 is unique-local space and fe80::/10 is link-local. A global IPv6 address can still be protected by firewall rules. Devices on the same Wi-Fi can legitimately use different IPv6 addresses.
Checking for CGNAT step by step
- Open your router’s admin page and find the IPv4 address of the internet (WAN) side.
- Compare it with the public IPv4 shown on PPORT’s My IP page.
- If they match, the router has a public IP and port forwarding can open access from outside.
- If the WAN address is in 100.64.0.0 to 100.127.255.255 (100.64.0.0/10) or a private range, there is another NAT above your router. In that case, port forwarding on your router alone will not open access from outside.
- Ask your ISP for a public IP, accept connections over IPv6, or consider an external relay such as a VPN or tunnel.
Where private ranges on your PC come from
| Range | Common source |
|---|---|
| 172.17.0.0/16 | Docker’s default bridge network (docker0) |
| Other ranges within 172.16.0.0/12 | Often chosen automatically by WSL2, virtual machines or custom Docker networks |
| 100.64.0.0/10 | Mesh VPNs such as Tailscale assign each device a 100.x.y.z address. This is unrelated to carrier-grade NAT |
If your home router’s range overlaps a Docker or VPN range, some devices may become unreachable. Check the address of each interface with ipconfig on Windows or ip -4 addr on Linux, and if they overlap, change the Docker or VPN range.