Public IP vs Private IP: What’s the Difference?

Through Network Address Translation (NAT), usually performed by your router or firewall. When a device at 192.168.1.20 opens a website, the router replaces the private source address with its own public IP and records the session in a translation table. When the reply comes back, the router checks that table and forwards the traffic to the correct internal device. Most home and office networks use PAT (Port Address Translation), a form of NAT that lets hundreds of devices share one public IP by tracking each session with a unique port number.

IPv4 has about 4.3 billion addresses, and that pool ran out years ago. Private addressing lets millions of organisations reuse the same internal ranges without conflict, because those ranges never appear on the public internet. Without private IPs, every laptop, printer, phone and smart bulb would need its own globally unique address, and IPv4 would have run dry much sooner than it did.

Somewhat, though not in the way people often assume. A private IP can’t be reached directly from the internet, so it isn’t exposed to random inbound scans. That protection comes from routing and NAT, not from any security feature of the address. Once malware, a phishing link or a compromised VPN account gets inside the network, private addresses offer no protection. Treat private addressing as a side benefit, and keep your firewalls, segmentation and endpoint security in place.

Two devices on different private networks can, and this happens all the time. Your router at home and your neighbour’s router are probably both 192.168.1.1, and neither notices. Public IPs must be unique worldwide. Inside a single network, a duplicate IP causes an address conflict and one or both devices lose connectivity. Overlapping private ranges also become a real headache when two companies merge or when you connect on-premises networks to the cloud over VPN, which is why IP address planning matters from day one.

Many ISPs, especially mobile and broadband providers in India, don’t have enough public IPv4 addresses for every customer. They use Carrier-Grade NAT (CGNAT), which adds a second layer of translation at the ISP level. Your router gets an address from the 100.64.0.0/10 range (RFC 6598), and the ISP translates it to a shared public IP. The catch is that hosting services, running a game server or setting up port forwarding becomes difficult or impossible, because you don’t control the public-facing address. If you need inbound access, ask your ISP for a static public IP, usually a paid add-on.

Yes, with a different design. IPv6 Global Unicast Addresses (from 2000::/3) are the public equivalent. Unique Local Addresses (fc00::/7, in practice fd00::/8) play a similar role to RFC 1918 space. The big difference is that IPv6 has enough addresses for every device to have a globally routable one, so NAT is not needed for address conservation. Security then depends on a stateful firewall rather than on the side effect of NAT.

In AWS, Azure and GCP, every virtual machine gets a private IP inside its VPC or VNet, and that’s what it uses to talk to other cloud resources. A public IP is optional and gets mapped to the instance through the provider’s internet gateway. Since 2024, AWS charges for every public IPv4 address, including ones attached to running instances, so architects now prefer private subnets with NAT gateways, load balancers or private endpoints, and assign public IPs only where they are actually needed.