Mental model
The internet ran out of unique IPv4 addresses long ago — 32 bits gives you only about 4 billion, and there are far more devices than that. RFC 1918 carved out three ranges that anyone can reuse inside their own network, as long as they don’t leak onto the public internet. Every home, office, and data centre uses these same ranges independently, and NAT (Network Address Translation) is what lets them all share the internet through public IPs.
The three private ranges
| Range | CIDR | Old class | Hosts (theoretical max) | Typical use |
|---|---|---|---|---|
| 10.0.0.0 – 10.255.255.255 | 10.0.0.0/8 | Class A | 16,777,214 | Enterprise, service providers, cloud VPCs |
| 172.16.0.0 – 172.31.255.255 | 172.16.0.0/12 | Class B block | 1,048,574 | Mid-size networks, campus labs |
| 192.168.0.0 – 192.168.255.255 | 192.168.0.0/16 | Class C block | 65,534 | Home, small office, SOHO routers |
The old class labels don’t matter for routing anymore (we’ve been classless since CIDR arrived in 1993), but they’re still handy for remembering which range is which size.
Why they exist
Two things wouldn’t work without RFC 1918:
- Address conservation. Every device inside a corporate network would otherwise need a globally-unique public IPv4. There aren’t enough left. Private ranges + NAT let millions of internal hosts share a handful of public IPs.
- Isolation by default. Because internet backbone routers drop packets to or from RFC 1918 addresses, your internal
10.10.5.20file server is unreachable from the outside — a free layer of security you don’t have to configure.
Special-purpose ranges (not RFC 1918 but often confused)
| Range | Purpose |
|---|---|
| 127.0.0.0/8 | Loopback — packets never leave the host (127.0.0.1 is the classic) |
| 169.254.0.0/16 | Link-local / APIPA — a Windows/Mac/Linux client assigns itself one when DHCP fails |
| 224.0.0.0/4 | Multicast |
| 100.64.0.0/10 | Carrier-grade NAT (CGN) — ISP-internal, not usable in customer networks |
| 0.0.0.0/8 | ”This network” — the default route uses 0.0.0.0/0 |
| 255.255.255.255 | Limited broadcast — never routed |
Seeing 169.254.x.x on your laptop is a telltale sign DHCP is broken.
How you’ll see this on the exam
- “Which of these can be used on the public internet?” → Anything not in the three RFC 1918 ranges (and not loopback, APIPA, multicast, or reserved).
- Given a network diagram, identify which addresses need NAT → any host in
10.0.0.0/8,172.16-31.0.0/12, or192.168.0.0/16that talks to the internet needs to be translated. - Duplicate private ranges across a merged network → the classic acquisition/merger problem: both companies use
192.168.1.0/24for their office, and now they can’t route to each other without renumbering or double-NAT.
Real-IOS: configuring an inside private LAN + NAT to the internet
R1(config)# interface GigabitEthernet0/0
R1(config-if)# description LAN — inside NAT
R1(config-if)# ip address 192.168.1.1 255.255.255.0
R1(config-if)# ip nat inside
R1(config-if)# no shutdown
!
R1(config)# interface GigabitEthernet0/1
R1(config-if)# description WAN — outside NAT
R1(config-if)# ip address 203.0.113.5 255.255.255.252
R1(config-if)# ip nat outside
R1(config-if)# no shutdown
!
R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/1 overload
Now every host in 192.168.1.0/24 reaches the internet by being translated to the router’s outside IP 203.0.113.5. See the dedicated NAT topic for the full walkthrough.
The #1 mistake
Using a public IP by mistake on your internal network. New engineers sometimes pick 1.1.1.1 or 8.8.8.8 for a lab because they’re memorable — and then wonder why their internal hosts can’t reach Google DNS or Cloudflare (those are Google DNS and Cloudflare, and now your router thinks the “internal” host is on the internet). Always start internal designs from the RFC 1918 ranges.
Quick verification
R1# show ip interface brief
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0 192.168.1.1 YES manual up up
GigabitEthernet0/1 203.0.113.5 YES manual up up
!
R1# show ip nat translations
Pro Inside global Inside local Outside local Outside global
tcp 203.0.113.5:1024 192.168.1.10:53212 8.8.8.8:443 8.8.8.8:443