Private IP Address Ranges and IP Address Classes Explained

Few topics are tested as consistently as this one. Expect questions that hand you an address and ask whether it is private, public, link-local, loopback or multicast, and questions that ask you to name the class. This guide gives the exact boundaries, counts verified by calculation, the reasoning behind each special range, how classful addressing worked and why it was retired, and eight practice questions for CompTIA Network+ and Cisco CCNA. This page is a reference for which addresses are private or special; for the binary math of splitting a network into subnets, use subnetting explained.

What are the private IP address ranges?

RFC 1918 reserves three blocks of IPv4 addresses for private use. They are the only ranges that the standard calls “private”.

“Total addresses” counts every address in the block, including the network and broadcast addresses if you treated each block as one subnet. In practice you split them into many subnets (see subnetting explained and VLSM explained). The count for a /12 is 2^20, which is 1,048,576, and that is why the block ends at 172.31.255.255. Memorize the boundary: the second octet runs from 16 to 31. The commonly mistaken addresses are 172.15.x.x and 172.32.x.x, which are public.

The private flag has nothing to do with the class of the address: 10.x.x.x is Class A, 172.16 to 172.31 is Class B and 192.168.x.x is Class C only because of where the first octet falls.

Why do private addresses exist?

By the early 1990s it was obvious that IPv4 would run out. RFC 1918 gave organizations three ranges that they could reuse independently: because every company could use 10.0.0.0/8 internally, a limited pool of public addresses could serve many networks. The trade-off is that private addresses are not unique and not routable on the internet, so a gateway has to translate them, which is NAT (see what is NAT). Three consequences follow. Two sites that both use 192.168.1.0/24 cannot be joined without renumbering or translation, so overlapping private ranges are a perennial VPN and merger problem. Internet routers discard packets with private source addresses, which also makes private source addresses on the internet a sign of spoofing or misconfiguration. And private address spaces are free: no registry fees, no allocation request.

APIPA, loopback, CGNAT and other special-use ranges

Besides the three RFC 1918 blocks, the special-use IPv4 ranges worth knowing are loopback (127.0.0.0/8), APIPA link-local (169.254.0.0/16), carrier-grade NAT shared space (100.64.0.0/10), multicast (224.0.0.0/4) and the reserved Class E block. RFC 6890 collects all special-purpose blocks, and IANA maintains the live registry (linked below).

Details on the three most-tested ranges follow.

APIPA (169.254.0.0/16)

Automatic Private IP Addressing is how a client behaves when it is set to use DHCP and cannot get a lease: it picks an address in 169.254.1.0 to 169.254.254.255, checks that no one else is using it, and continues with no gateway. It is a first-class troubleshooting clue, since it means the DHCP exchange failed, not that the network is broken in general. Hosts on the same link with APIPA addresses can talk to each other, but nothing beyond. In the exam it reads “the user can reach local peers but not the internet; address starts with 169.254”.

Loopback (127.0.0.0/8)

Packets to any 127.x.x.x address are delivered back to the same host. The usual address is 127.0.0.1 (hostname localhost), and ping 127.0.0.1 tests the local IP stack without touching the network card or cable.

CGNAT shared space (100.64.0.0/10)

It is not private in the RFC 1918 sense, and is not public either. RFC 6598 reserved it so that an ISP running carrier-grade NAT has addresses that do not collide with customers' own RFC 1918 networks. If a home router's WAN address is in 100.64.0.0 to 100.127.255.255, the ISP is translating you and inbound port forwarding will not work.

What are IP address classes A to E?

Before 1993, IPv4 used classful addressing: the first few bits of an address decided its class, and the class decided where the network part ended. The classes were part of the original specification, RFC 791.

How the numbers come from the bits. Class A has 7 usable bits for the network (the first bit is fixed at 0), so 2^7 = 128 networks, minus the all-zeros network 0 and the 127 loopback network, gives 126 by the usual convention. Class A hosts: 24 host bits, so 2^24 - 2 = 16,777,214. Class B has 14 free network bits (2^14 = 16,384 networks) and 16 host bits (2^16 - 2 = 65,534 hosts). Class C has 21 free network bits (2^21 = 2,097,152 networks) and 8 host bits (2^8 - 2 = 254 hosts). The two subtracted addresses in every host count are the network address (all host bits 0) and the broadcast address (all host bits 1).

Quick identification: look at the first octet only. 1 to 126 is A, 128 to 191 is B, 192 to 223 is C, 224 to 239 is D and 240 and up is E. The first octet 127 is skipped because it is loopback. Binary tip: count the leading 1 bits: none is A, one is B, two is C, three is D, four is E.

Check yourself

Why did CIDR replace IP address classes?

Classes forced organizations into three sizes. A business needing 300 hosts was too big for a Class C (254 hosts), so it was handed a Class B with 65,534 addresses and wasted nearly all of them. At the same time, routing tables grew because each class C network was a separate route. In 1993 the internet moved to Classless Inter-Domain Routing (CIDR; the current specification is RFC 4632, building on RFC 1519), where the prefix length is written explicitly (/22, /27) and blocks can be any size on any bit boundary. That allows right-sized allocations and route summarization (supernetting).

The practical consequence for exams: a class is a first-octet rule, but a mask is a separate property. 10.1.1.0/24 is a Class A address on a /24 network, and routers and routing protocols use the prefix length, not the class. A routing protocol described as “classful” (the original RIP) assumes the default mask, while “classless” protocols (RIPv2, OSPF, EIGRP, BGP) carry the mask. For the binary math see subnetting explained; to see classless protocols in action read OSPF explained.

How do I identify an address type quickly?

Check the first octet, then the second where needed: 127 is loopback, 169.254 is APIPA, 10 is private, 172.16 to 172.31 is private, 192.168 is private, 100.64 to 100.127 is CGNAT space, 224 to 239 is multicast, and the rest is public unless it is a documented special range. Run the address through these checks in order:

1. First octet 127? Loopback.
2. Starts with 169.254? APIPA / link-local.
3. First octet 10? Private.
4. 172 and second octet between 16 and 31? Private. Otherwise public.
5. 192.168? Private. Any other 192.x is public (except the special 192.0.0.x and 192.0.2.x documentation ranges).
6. 100 and second octet between 64 and 127? CGNAT shared space.
7. First octet 224 to 239? Multicast. 240 or higher? Reserved (or 255.255.255.255 broadcast).
8. Anything else (outside the special-use table above)? Treat as public unicast.

Then, if the question asks for the class, ignore all of the above and look at the first octet alone.

Where are private ranges used in real networks?

Private ranges are used almost everywhere inside organizations: homes use a 192.168 /24, offices carve per-VLAN subnets from 10.0.0.0/8 or 172.16.0.0/12, and cloud networks use the same blocks inside a VPC. Typical patterns:

• Home: routers typically use a /24 from 192.168.0.0/16 (commonly 192.168.0.0/24 or 192.168.1.0/24) with DHCP, and PAT to the ISP address.
• Office: one subnet per department or VLAN, carved from 10.0.0.0/8 or 172.16.0.0/12, for example 10.10.10.0/24 for staff and 10.10.20.0/24 for voice.
• Data center and branch networks: 10.0.0.0/8 is the usual choice because it is the biggest block and easily split into per-site /16s.
• Remote access and VPN: overlapping ranges between home and office are a common cause of failed VPN connections, so a less common range (for example 10.x with an unusual second octet) avoids conflicts.
• Container and virtualization defaults: some platforms reserve private ranges internally; for instance Docker's default bridge network commonly uses 172.17.0.0/16, so avoid overlapping it when you plan a VPC or VPN range.

The IPv6 equivalent of RFC 1918 is the unique local range fc00::/7; see IPv4 vs IPv6 for how it compares, plus link-local fe80::/10.

How do private ranges work in AWS and Google Cloud?

Cloud virtual networks reuse the same private addressing, which is why this topic also feeds AWS Cloud Practitioner and Google Cloud networking questions.

• AWS VPC. When you create a VPC you choose an IPv4 CIDR block. AWS documents an allowed IPv4 size from /16 down to /28 and recommends choosing from the RFC 1918 ranges. It also restricts some special-use blocks, so check the AWS VPC CIDR page linked in the sources for the current list rather than relying on a copy here.
• Google Cloud VPC. Subnets use RFC 1918 ranges for primary ranges, and Google documents that other ranges such as 100.64.0.0/10 shared address space can be valid too, while loopback and multicast are not. Auto-mode networks create one subnet per region from the 10.128.0.0/9 block, and you should avoid overlapping that block with your own custom subnets.
• Why it matters. Overlapping ranges prevent VPC peering and VPN connectivity, so plan non-overlapping ranges before building anything. Instances with private addresses reach the internet through NAT (a NAT gateway on AWS, Cloud NAT on Google Cloud), the same translation idea covered in the NAT guide. Our overview of Google Cloud networking fundamentals goes deeper on the VPC model.

Cloud details change, so check the provider pages in the sources for current limits before relying on a number in a design.

Common exam traps

Most errors here are boundary errors: 172.15 and 172.32 are public, 192.169 is public, and class does not decide whether an address is private. The full list:

• 172.16.0.0/12 ends at 172.31.255.255. 172.32.x.x is public, and so is 172.15.x.x.
• 192.168 only. 192.169.x.x and 192.0.x.x are not private.
• All of 127/8 is loopback. 127.0.0.1 is the common one, but 127.5.5.5 is loopback too.
• Class does not mean private. A Class B address like 150.1.1.1 is public. The private ranges happen to sit in A, B and C.
• Class A is 1 to 126, not 1 to 127. 127 is loopback; 0 is not usable as a host network.
• Host counts subtract two. Class C hosts are 254, not 256.
• APIPA is not a DHCP address. It means DHCP failed.
• Multicast is Class D. 224.0.0.0 through 239.255.255.255; never a host's own address.
• CGNAT space is neither private nor public. 100.64.0.0/10 is its own category (RFC 6598).
• Classful versus classless routing. Modern protocols carry the mask, so a Class A address can be on a /24.

How do Network+ and CCNA test this?

CompTIA Network+ N10-009 tests recognition: identify the address type from a sample, name APIPA from a symptom, and know which ranges are private. It appears alongside subnetting and IPv6 in the Network+ cheat sheet. Confirm exact objective wording on the CompTIA page, since the blueprint can change between versions.

Cisco CCNA 200-301 expects you to describe private IPv4 addressing (RFC 1918), a Network Fundamentals topic, and you will use it in IP configuration, NAT and subnetting questions. Classful boundaries still come up when explaining summarization and default masks, and the CCNA cheat sheet lists them. The Network+ vs CCNA comparison explains how the depth differs. Related fundamentals: the OSI model and TCP vs UDP.

Identify-the-address practice questions

Classify each address, then open the answer. For more, use the Network+ practice exam or the CCNA practice exam.

Frequently asked questions

How we wrote and checked this

CertSharp is a practice-exam provider, so we have a commercial interest in exam preparation. This guide was written from RFC 1918, RFC 6890, RFC 3927, RFC 6598 and the IANA registry linked below. The range boundaries, address counts and class tables were verified with a script (Python's ipaddress module). Cloud limits change, so we point to the AWS and Google Cloud pages instead of copying them. Last reviewed on October 18, 2026. Confirm exam objective wording on the CompTIA and Cisco pages.

Sources and further reading

• RFC 1918: Address Allocation for Private Internets
• RFC 6890: Special-Purpose IP Address Registries
• IANA IPv4 Special-Purpose Address Registry
• RFC 3927: Dynamic Configuration of IPv4 Link-Local Addresses
• RFC 6598: IANA-Reserved IPv4 Prefix for Shared Address Space
• RFC 791: Internet Protocol (original IPv4 classes)
• RFC 4632: Classless Inter-domain Routing (CIDR)
• AWS: VPC CIDR blocks
• Google Cloud: VPC subnets
• CompTIA Network+ certification page
• Cisco Learning Network: CCNA 200-301 exam topics