Private IP Address Ranges: What Proxies Change

Private IP address ranges can make a healthy proxy look broken when you compare a LAN address with the public exit IP a website sees.

This reference is for people checking a home, office, VPN, or proxy connection. It lists the IPv4 ranges, traces each address through NAT and a proxy, and gives a five-check method for finding the value that matters.

Key takeaways

• RFC 1918 reserves exactly three private IPv4 blocks, each with a fixed boundary shown below.
• A private address has meaning inside its current network. Separate networks can reuse the same value without creating a public-internet conflict.
• NAT presents a public address to the internet. A correctly routed proxy request presents an outbound proxy address to the destination, while the device keeps its private LAN address.
• Classify the observation point before diagnosing a mismatch: device settings show a local address, a public-IP lookup shows that request's public address, and a proxy test shows the exit used by the proxy.

Which private IP address ranges does RFC 1918 reserve?

In February 1996, RFC 1918 reserved three IPv4 blocks for private networks. Their routes are not meant to be propagated across the public internet.

• 10.0.0.0/8 covers 10.0.0.0 through 10.255.255.255.
• 172.16.0.0/12 covers 172.16.0.0 through 172.31.255.255.
• 192.168.0.0/16 covers 192.168.0.0 through 192.168.255.255.

The prefix lengths also give an exact size check. Calculated as 2^(32-prefix), /8 contains 16,777,216 total addresses, /12 contains 1,048,576, and /16 contains 65,536. Those totals describe block size; usable-host counts depend on subnetting and network rules.

The boundaries are narrow. ARIN warns that only part of the 172 and 192 address space is private. Checking the full boundary prevents a broad 172 or 192 label from producing the wrong classification.

Why can two networks use the same private IP address?

RFC 1918 explains that private addresses have no global meaning. Different private networks can therefore use the same value without coordinating. Each address must remain unique within the network where it is active.

Consider a composite troubleshooting case. Two offices each have a printer at 192.168.1.40. Both work because the networks are separate. Connect those offices through a VPN without planning for overlap, and traffic for 192.168.1.40 becomes ambiguous. The duplicate was harmless until the routing domains met.

This is why a 10.x or 192.168.x result often says more about where you looked than whether a proxy worked. A local address can remain stable while the public path changes several times.

What public IP does a website see after NAT?

Without a proxy, a typical home or office request starts at a private interface and crosses the router. Network address translation, or NAT, maps that private flow to the router's public address. The remote website records the public source for the request. The laptop retains its 192.168 or 10 address.

• Device interface: 192.168.1.24, a private address.
• Router public address: 198.51.100.27 in this documentation-only example.
• Website observation: the public source address, 198.51.100.27.

ColdProxy's My IP tool is built for that public observation point. It shows the public IPv4 and IPv6 available to the browser request; it does not discover the private LAN address stored on your device.

What changes when a proxy is added?

A proxy inserts another outbound hop. The application connects to a gateway, and the proxy sends the request from an exit IP. The destination records that exit when the application actually uses the proxy. For the mechanical distinction, see proxy gateway versus exit IP.

A useful four-address trace separates the values instead of comparing them as if they were interchangeable:

1. Device private address: 192.168.1.24.
2. Normal public address after the local router: 198.51.100.27 in this example.
3. Proxy gateway: gw-2312.coldproxy.com:30000, the documented connection endpoint.
4. Proxy exit: 203.0.113.42 in this documentation-only example, the address the destination records.

The private device address does not need to change. The result that matters is the public address returned for the proxied request. ColdProxy documents this connection pattern:

1curl -x "http://USERNAME:PASSWORD@gw-2312.coldproxy.com:30000" https://api.vipv6proxy.com/api/checker/my-ip

Read the JSON ip field as the public exit for that request. If you prefer a form instead of a command, the Proxy Checker reports IPv4 and IPv6 reachability, the working exit IP, location fields, and a failure reason for each tested family. The proxy verification guide explains the same reachability, exit, and location checkpoints.

There is one hard limit to this test: an app can bypass a system-wide proxy setting or send only some traffic through it. Verify the route in the same application and request path you intend to use.

Which similar-looking ranges are not RFC 1918 private space?

Several non-public IPv4 blocks serve other purposes. Calling all of them private RFC 1918 space hides useful diagnostic clues.

• IANA registers 127.0.0.0/8 as Loopback. It sits outside the Private-Use entries. Source: IANA IPv4 Special-Purpose Address Registry
• IANA registers 169.254.0.0/16 as Link Local. It sits outside the Private-Use entries. Source: IANA IPv4 Special-Purpose Address Registry
• 100.64.0.0/10 is Shared Address Space for service-provider Carrier-Grade NAT. It is distinct from RFC 1918 private space.

Published in April 2012, RFC 6598 states: "Shared Address Space is distinct from RFC 1918 private address space because it is intended for use on Service Provider networks."

An address from 100.64 through 100.127 can therefore point to another translation layer upstream rather than the device's local RFC 1918 block.

How can you tell which IP address you are looking at?

Use the four-address trace as a decision framework. Name the observation point first, then classify the value. This prevents a local interface address, a router address, a gateway, and an exit IP from being judged against the wrong expectation.

Composite scenario: a QA analyst enables a proxy, sees 10.24.7.18 in the operating-system network panel, and sees 203.0.113.42 in a proxy result. The values look unrelated, so the proxy is marked failed. The conclusion compares two layers: the first value belongs to the laptop, while the second belongs to the outbound proxy path.

1. Record the exact value and where it appeared: device settings, browser lookup, gateway field, proxy checker, or destination log.
2. Compare an IPv4 value with the three RFC 1918 blocks. If it matches, treat it as local to the current private network.
3. Check the three special-purpose exceptions above before making a public/private call. Each one describes a different networking context.
4. Run one public-IP check without the proxy and one through the intended proxy path. Keep the application and target endpoint consistent.
5. Compare like with like: normal public address against proxy exit, or configured gateway against the gateway your client used. Do not compare the device's LAN address with the exit.

If the proxied check cannot reach either address family, that is a connection failure. If at least one family works and returns an exit, the local private address remaining unchanged is expected behavior.

What should you check before blaming the proxy?

Start with the layer, not the number. Private IP address ranges classify the device-side network; NAT defines the normal public path; the gateway defines where the client connects; and the exit defines what the destination records. Once those roles are separated, most apparent mismatches become easy to explain.

Use the Proxy Checker when you need the exit for a specific proxy. If you are still choosing an outbound path, compare the public ColdProxy proxy options without assuming that one proxy type fits every workflow.

Frequently Asked Questions

Is 192.168.0.1 a private IP address?

Yes. 192.168.0.1 falls inside 192.168.0.0/16, which runs through 192.168.255.255. It can identify a device only within its current network. A remote website will see a translated public address or that proxy's outbound address, depending on the route the request takes.

Is every 172 IP address private?

No. The private slice starts at 172.16.0.0 and ends at 172.31.255.255. Addresses such as 172.15.0.1 and 172.32.0.1 fall outside that RFC 1918 block. Check the full range before labeling a 172 address as private; the surrounding space is public address space.

Does a proxy change my private IP address?

No. A proxy changes the outbound route for traffic the application sends through it. Your laptop can keep 192.168.1.24 while the website records that proxy's exit address. If the app bypasses the proxy, the destination may still see your normal public address.

Can two devices have the same private IP address?

Yes, when they sit on separate private networks. A laptop at home and a printer in another office can both use 192.168.1.20 because each address has meaning only within its own network. Put them on the same subnet, however, and the duplicate creates an address conflict.

Does RFC 1918 apply to IPv6?

No. RFC 1918 defines private-use ranges for IPv4. IPv6 uses separate address categories and prefix rules, so the three IPv4 blocks in this guide cannot classify an IPv6 address. Use an IPv6-specific registry or standard and evaluate the full IPv6 prefix for a reliable result.