Public vs private IP: why your IP looks different

Why your computer's IP address differs from the one websites see: private ranges, NAT, carrier-grade NAT, IPv6 temporary addresses, and how to see each one.

Open your network settings and you see an address like 192.168.1.23. Open host.sh and it shows something else, like 203.0.113.7. Both are right. The first is your device's address on your own network; the second is the public address your traffic comes from on the internet, usually your router's or your provider's. This guide explains which ranges are private, what sits in between, and how to see each address yourself.

The private and special ranges

These blocks are reserved and never identify a device on the public internet. The IANA special-purpose registries mark all of them as not globally reachable:

RFC 1918 addresses are unique only within one organisation's network, so millions of homes use 192.168.1.1 at the same time. They may be routed freely inside a network, but RFC 1918 says they should not be forwarded across the links between organisations, and providers are expected to filter them, so they don't identify anyone on the public internet. That is why a lookup of a private address tells you nothing about where it is: host.sh and every other lookup can only locate public addresses.

NAT: many devices, one public address

Your router has two sides: a private address on your network and a public one towards your provider. When a device sends a request out, the router rewrites the source to its public address and remembers the connection, so the reply finds its way back. This is network address translation (NAT), described for this use in RFC 3022. Every device behind the router shares the same public IPv4 address, which is why your laptop and phone show the same address on host.sh while their own settings show different private ones.

Carrier-grade NAT: your provider shares it too

Public IPv4 addresses are scarce, so some providers, mobile networks especially, add a second NAT in their own network. Your router then gets an address from the shared range 100.64.0.0/10, or sometimes a private one, and the provider translates it again to a public address shared with other customers. RFC 6598 set that range aside for exactly this: numbering the links between the provider's NAT and its customers' routers.

A sign of carrier-grade NAT is that the internet (WAN) address on your router's status page is not the address websites see:

curl -4 https://host.sh/ip

A WAN address in 100.64.0.0/10 points strongly at your provider's NAT. A private WAN address or a plain mismatch has other possible causes too: a VPN or proxy on your device, or a second router of your own in front of the first. Rule those out before you conclude it is your provider. If it is, RFC 7021 lists what changes:

• Port forwarding on your router can't make a server reachable from outside: it only adds a mapping on your own router, while the provider's NAT in front of it has none for you and is not yours to configure.
• Other customers share your public address, so a block or rate limit on that address can hit you for something you didn't do.
• A location lookup of the shared address is less precise: the provider's NAT can serve customers across a wide area.

IPv6: public addresses again, but they change

IPv6 has enough addresses for every device to get a public one, so IPv6 networks usually work without NAT: the address a website sees over IPv6 is your device's own. It still may not match the address in your settings. Many systems create temporary addresses with a random interface part for outgoing connections, to make tracking by address harder (RFC 8981). With the RFC's defaults a temporary address is preferred for one day and valid for two, so the IPv6 address websites see typically changes every day while the network prefix, its first half, stays.

Your device also has an fe80:: link-local address on every interface and may have an fd.. unique local one. Neither is ever seen by websites. The IPv6 test shows which of your two public addresses, IPv6 or IPv4, a site sees.

How to see each address

Your public address, as websites see it:

curl https://host.sh/ip

The curl page has the IPv4 and IPv6 variants, and the IP lookup shows it in the browser with its network and location.

Your device's own addresses:

ip -4 addr show          # Linux, IPv4 (ip -6 addr show for IPv6)
hostname -I              # Linux, every address on one line
ipconfig getifaddr en0   # macOS, the first network interface
ipconfig                 # Windows, every adapter

Your router's public side is on its status or WAN page in the router's admin interface, usually at the address shown as the default gateway.

FAQ

Why is my IP address different on my computer and on websites?

Your computer shows its private address on your home or office network, such as 192.168.1.23. Websites see the public address your router or provider translates it to with NAT. Over IPv6 there is usually no NAT, but your device uses a temporary address for outgoing connections.

Is 192.168.x.x a public IP address?

No. 192.168.0.0/16 is one of the three private ranges of RFC 1918, with 10.0.0.0/8 and 172.16.0.0/12. These addresses are used inside networks and are not reachable from the internet.

What is a 100.64.x.x address?

It is from the shared address space 100.64.0.0/10 that RFC 6598 reserved for carrier-grade NAT. If your router has one, your provider translates your traffic to a public address shared with other customers.

Why does my IPv6 address keep changing?

Your device uses temporary IPv6 addresses for outgoing connections and replaces them regularly, by default about once a day under RFC 8981, so sites can't track you by a fixed address. The network prefix stays the same.

Can someone find my location from my private IP address?

No. Private addresses are reused in millions of networks and mean nothing outside yours. Only your public address can be looked up, and a lookup of it usually gives your provider's area, not your home.

This page as Markdown: /guides/public-vs-private-ip/index.md