26

I know that the organization that distributes IP addresses decided to assign 192.168.xxx, 172.xxx and 10.xxx to private networks. However, I thought that private networks have their own address space so shouldn't a private network be able to assign any values in the IP address space and not be limited to those values?

Assuming IPV4 CIDR notation

Improve this question
3

5 Answers 5

Reset to default
52

RFC 1918 allocates the following for private address space:

  1. 10.0.0.0/8
  2. 172.16.0.0/12 (not 172.0.0.0/8!!!)
  3. 192.168.0.0/16

While those are private, network engineers often use NAT to allow users on those nets to reach internet resources.

If you used 8.0.0.0/8 for private address space (for example), you would not be able to reach the google address server 8.8.8.8, because you would have an internal route for that block.

In addition, even if your “private” servers did not need to reach the internet at all, if google tried to reach your public webserver, and your public webserver had your internal routing table (with your “private” 8-net route), the replies would not get back to google.

So use the RFC1918 private address space and save yourself a bunch of trouble.

Improve this answer
8
  • Correct me if I'm wrong, so if we assign a set of addresses in our private network, it will always use that internal route if the address we are accessing is in the range of our network. However, if we try to access something that is not in that range we will then go to the NAT gateway
    – coderhk
    Jan 20, 2020 at 4:17
  • 8
    It depends on your routing but yes, usually you will have specific internal routes which will be preferred over a default route to the internet. So using someone else’s space internally will prevent you from accessing their sites, and may prevent them from accessing your public sites. That’s a lose-lose situation.
    – Darrell Root
    Jan 20, 2020 at 7:10
  • 8
    There's a very real example of this happening. 1.x.x.x was left unallocated until a few years ago, so it sometimes got used for private addressing. When Cloudflare set up 1.1.1.1 and 1.0.0.1 as public DNS servers, some clients couldn't reach them because they were behind a net that did weird things with those addresses. See this Cloudflare blog article.
    – Gordon Davisson
    Jan 21, 2020 at 1:42
  • 3
    Doesn't have anything to do with NAT or routers. Routers are not involved if your PC is addressed 8.1.1.100 /8 and you try and access google DNS at 8.8.8.8. It will either reach the 8.8.8.8 directly connected on your net (if there is one) or if there isn't one it will fail.
    – AbraCadaver
    Jan 21, 2020 at 19:00
  • 2
    @DoktorJ Routers don't provide routing tables to clients. The point Abra is making is that if a device is sat on the 8.0.0.0/8 range then it'll never even try to get off the network
    – Dan
    Jan 22, 2020 at 12:04
15

If you use assigned global address space internally -- and pretty much all of it is assigned now -- your users will not be able to reach the real internet site(s) at those addresses. That's the entire reason RFC1918 defined 192.168.0.0/16, 172.16.0.0/12, and 10.0.0.0/8. Those blocks will never be assigned and routed on the global internet, so you can safely use them internally without interference.

(The only issue is two orgs using overlapping private ranges. But that's their problem.)

Improve this answer
7

You're not technically limited to just 192.168.0.0/16, 172.16.0.0/12, and 10.0.0.0/8 (in an IPv4 network). You can use whatever you want privately. The deal is that everything else, with the exception of a few other restricted subnets (such as multicast, localhost, APIPA, etc.) are routable on the internet, so if you decide to use something other than 192.168.0.0/16, 172.16.0.0/12, or 10.0.0.0/8 privately (in an IPv4 network), such as 100.200.0.0/16, keep in mind that you will not be able to talk with the organization that actually has 100.200.0.0/16 assigned to them.

Improve this answer
10
  • 5
    @M.Rostami More or less. There is no technical reason someone couldn't use a public IP address internally, but they have to understand the implications of they do. It's a bad practice, and the subnets defined in RFC 1918 are more than enough for most organizations but if they're not for yours, your better solution would be to convert to IPv6.
    – Jesse P.
    Jan 20, 2020 at 12:20
  • 1
    @WGroleau Correct but it is still a bad practice. Many websites and apps have things like API calls and graphics that may be hosted around the world, and you may inadvertantly block them and cause issues. Avoid using anything but the allocated private subnets unless there's absolutely no alternative.
    – Jesse P.
    Jan 20, 2020 at 17:10
  • 1
    I didn’t recommend it, though I personally would not trust an API that demands access to China. :-)
    – WGroleau
    Jan 20, 2020 at 17:26
  • 6
    @M.Rostami All of the internet is just an agreement between organizations. The rules of internetworking are not "laws", they are spelled out in "Requests For Comments", a name that does not sound liek it makes the specifications really compelling. You can use other networks than suggested by RFC1918, use different mail standards than in RFC822, run a web server that ignores RFC2616, or even a different IP protocol than the one described in RFC722 or RFC2460. [...]
    – Hagen von Eitzen
    Jan 20, 2020 at 21:44
  • 3
    [...] However, by not abiding to the "suggestions", you will lose functionality (some network not reachable, mail not transmittable, webserver not functional for the public, or no communication whatsoever possible) and may perhaps not be considered a good netizen
    – Hagen von Eitzen
    Jan 20, 2020 at 21:44
4

First, you should use RFC 1918 addresses in your internal network because none of those addresses will be associated with a service on the Internet. Whatever external address the service on example.com has, it cannot be an RFC 1918 address because those are not routed on the Internet. So, those addresses are "safe to use" within your own network.

Second, I personally know a very large organization that uses the complete IPv4 unicast address space internally. Yes, all of it. But how could you do that when you still want to reach Gmail or Twitter? Well, in many company networks, external Internet access is limited anyway: You can use e-mail with the internal mail server and have Web access over a proxy server. Those proxies and servers of course need contact to the Internet with "official" (i.e. routable) IP addresses to work, but this is not a big problem to achieve with an appropriate infrastructure (DMZs and some firewalls). But forget any services that need NAT traversal or direct connections.

So, is it feasible? Yes, if you can restrict your Internet usage to some services that can be proxied by internal servers. Is it advisable? Certainly not.

(And after all, with IPv6 nobody should have the need to use otherwise allocated IP space for their own networks. There is enough for everyone, if we are not too lavish.)

Improve this answer
-2

Private IP Address

You can use any private IP address range within your private network. A private network can use both IPv4 and IPv6 addresses. Private IP ranges are NOT allocated to any particular organization

  • Private IP Ranges specified by RFC 1918
    • Class A: 10.x.x.x - 10.255.255.255 (CIDR - 10.0.0.0/8),255.0.0.0, 24 bit block
    • Class B: 172.16.x.x - 172.31.255.255 (CIDR - 172.16.0.0/12), 255.240.0.0, 20 bit block
    • Class C: 192.168.x.x - 192.168.255.255 (CIDR - 172.16.0.0/16), 255.255.0.0, 16 bit block

  • Available hosts per IP class

    • Class A: 16,777,216
    • Class B: 1,048,576
    • Class C: 65,536

  • Not routable on the Internet

  • Does not require issuance by IANA (Internet Assigned Number Authority)
  • Used within a 'private' local network space
  • Communicates to other private LAN's and hosts

Public IP Addresses

  • Public IP Ranges Specified by RFC
    • Class A: 0.0.0.0 - 127.255.255.255
    • Class B: 128.0.0.0 - 191.255.255.255
    • Class C: 192.0.0.0 - 223.255.255.255
  • Used on the Internet
  • Temporarily issued to customers by ISP's
  • Permanently issued to customers by IANA
  • Network addresses cannot be changed without co-ordination with a public network provider (ISP)

Routing Private to Public

Accessing public network from a private network requires the use of NAT (Network Address Translation) which modifies the private IP packet headers when they transit from private to a public network across a routing device that will perform the NAT translation to the public network. A routing device can be a firewall, router or Layer 3 switch.

There's the basics. Hope this is helpful.

Improve this answer
4
  • 5
    BTW, classes haven't been used for decades.
    – Ricky
    Jan 23, 2020 at 1:41
  • You should go tell these old IBM knowledge base writers too. You have a lot of work ahead of you making the world a more better at conforming to your desired nomenclature place. ibm.com/support/knowledgecenter/SSSHRK_4.2.0/disco/concept/…
    – Citizen
    Jan 23, 2020 at 2:35
  • 3
    @Citizen, just like IPv6, it has to start somewhere and if enough people start pushing the idea, eventually the rest of the world will catch up to reality. Personally, whenever I interview potential network candidates, any mention of classes like they still exist is of concern and will at least count against them when comparing candidates if not eliminating them from consideration entirely.
    – YLearn
    Jan 23, 2020 at 4:30
  • 3
    When people say class a, b, c, they mean /8, /16, and /24 -- while technically incorrect, it's on par with a typo. What you've parroted under Public IP Addresses is classful networking. That went away LONG ago, and is absolutely wrong to continue preaching.
    – Ricky
    Jan 23, 2020 at 5:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.