I have started to work in a multinational company which has a global network spanning across 4 continents (20 0000+ network devices). I noticed that a lot of end user devices (PCs, laptops) have IP addresses like,,, etc., i.e. public IP addresses. And absolute majority of those devices have the connection to the Internet. I suppose network designers consciously chose to use public IPs inside private networks? But there must be some justification in doing so? In which cases is it beneficial to have public IP addresses within private networks? And what are the downsides/pitfalls of this scheme? What if a company's PC with "local" IP tries to access some 3rd party resource on external network which public IP is incidentally ?

  • Are you in control of the network? Can't you tell if your company owns the addresses? As part of your job, you should understand why this was done.
    – Ron Maupin
    Jul 20, 2018 at 17:24
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 25, 2018 at 9:07

3 Answers 3


The first thing you need to figure out is whether the public addresses in your network are in fact assigned to your company.

If the answer is Yes, it's likely because those addresses were available to use and address space wasn't an issue at the time. There is no problem in using public addresses, and it has one advantage of making troubleshooting easier.

If the answer is No, then you have a problem. As you point out, if you use someone else's addresses inside your network, you will not be able to reach those addresses on the Internet.

  • In case my company owns those public IPs, I should see my company's name listed if I searched for 22.x.x.x in google? If so, then no, the company does not own any of those IP address ranges. The IPs I provided in my question are made up (except the first octets of each example). But earlier today at work I tried to search for the actual 22.x.x.x and 124.x.x.x IPs which were assigned to laptops and found out that 22.x.x.x belongs to DoD Network Information Center, and 124.x.x.x belongs to some South Korean ISP. And none of these are the ISPs of our company
    – kamokoba
    Jul 20, 2018 at 17:48
  • 3
    Wow. If that's true, then that's very poor practice. There will be cases where you make parts of the Internet unreachable. Obviously, it hasn't caused a problem in the past (or maybe it has?). As organizations renumber, this could cause new problems. But as a new engineer, you need to weigh this issue against all the others your organization might have. you may have more important things to worry about.
    – Ron Trunk
    Jul 20, 2018 at 17:58

Originally there was no need to conserve IPv4 addresses and NAT did not exist, so it was normal for organisations to number their entire internal networks with public addresses. Some larger organisations were assigned entire Class A addresses. A lot of these have now been reclaimed and the organisations have renumbered with private addresses.

I have seen examples recently were companies need to provide services to other companies and use public addressing even though those services will never see the Internet. These public addresses are used to guarantee uniqueness between the companies so that services that do not respond well to NAT can be shared. This would be on a much smaller scale though, with only key services receiving public addresses and I suspect RIRs would ask for the addresses back if they knew it was used for this purpose.

I have also seen companies use public addressing internally just because they didn’t know what they were doing and didn’t know about private addressing when their networks were first created.

If a company uses addresses that don't belong to the organisation there can be issues when routing to companies that actually own those addresses.

Your addresses are currently assigned to: – Defence Information Systems Agency – SK Telecom – Wayne State University

Does your company have associations to these organisations? One is registered through ARIN, one through APNIC and another looks like defence.

  • Thank you, Karl, your answer clarifies a lot of things for me. Indeed, my company does provide services to other companies and vice versa (i believe this setup is called Extranet). But no, the company i work in does not have any associations with those organisations that you listed, so that bit remains a bit of a mistery - the IPs belong to the organizations we have nothing to do with yet we use their IPs in our internal network lol
    – kamokoba
    Jul 20, 2018 at 18:02
  • 1
    Not so much public addresses, but unallocated addresses that later became public. It was a (bad but) common practice in the long-long-ago to use unallocated addresses -- 1/8 being a now infamous case. It was somewhat less common to see companies numbered with their ISP's addresses that simply never renumbered. (eg. I still haven't bothered renumbering my former /28 -- I'll never need to reach the real nodes at those addresses, and it's just me, so meh.)
    – Ricky
    Jul 20, 2018 at 21:44
  • "not respond well to NAT" referring to?
    – Pacerier
    Sep 1, 2022 at 11:50

Using "unallocated" IP addresses internally will prevent anyone on your network from reaching the real destinations on the internet that use those addresses, but it's not a vulnerability per se; it's just ignorant behavior.

Using "allocated" Public IP addresses internally is a significant cyber vulnerability.

Simply put, using ICANN public IP internally means that if any point in your network was inadvertently, maliciously, etc. directly connected to the internet, then your subnet or potentially your whole network would immediately become a visible extension of the internet. Everyone on the internet could ping any of your printers, PCs, servers, etc. Traffic from China would route just fine to your printers, PCs, servers, etc.

How would this happen? Well an insider could easily do it in 5 minutes with a MiFi unit. An external firewall could be mis-configured. Phishing could also pull in some interesting code to create an embedded network channel. In short, lots of ways.

If you have this setup, change it asap as you may already have been hacked and just don't know it. How? Your main internet connected firewall(s) need to use NAT and DHCP to hand out private IP addresses in the range 10.X.X.X or 172.20.X.X or 192.168.X.X.

Easy to do, no excuse not to.

  • 1
    No, traffic will be not be routed to the network unless announced in BGP. If the company does use BGP to advertise some prefixes to the Internet, yes then a misconfiguration could cause the misused address space to be announced (altough it should be filtered by the upstream) but this cannot happen wit a mobile wifi hotspot. Also "Easy to do, no excuse not to." , not so for a multinational company which has a global network spanning across 4 continents (20 0000+ network devices).
    – JFL
    May 18, 2020 at 14:38
  • NAT and private addressing has nothing to do with security. Security comes from firewalls, not NAT. The NAT device has full access to the internal network, and compromising the NAT device gives you full access to the internal network, private addressing or not.
    – Ron Maupin
    May 18, 2020 at 14:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.