Private, Public & Special Addresses

In one line

Some ranges are reserved for private networks, loopback, link-local, and other special uses; recognising them on sight speeds up every debugging session.

0/4 · 0%

Key ideas

01
PRIVATE ranges (RFC 1918), usable inside any organisation and never routed on the public internet: 10.0.0.0/8, 172.16.0.0/12 (172.16–172.31), 192.168.0.0/16. Your home network, VPCs, and Docker bridges all use these.
02
LOOPBACK 127.0.0.0/8 (usually 127.0.0.1, name localhost): traffic never leaves the machine. A service listening only on 127.0.0.1 is unreachable from other hosts, including other containers. This is a very common 'it works locally but not in Docker' cause.
03
0.0.0.0 means 'all interfaces' when a server binds to it ('listen everywhere'), and 'any/default' in routing tables (0.0.0.0/0 is the default route: everything).
04
LINK-LOCAL 169.254.0.0/16: addresses valid only on the local link. Cloud metadata services live here (169.254.169.254, DevSecOps course Lab 3.3). A machine that self-assigns a 169.254 address usually failed to get one from DHCP.
05
CARRIER-GRADE NAT 100.64.0.0/10: used by ISPs, and often by Kubernetes (EKS custom pod networking, Tailscale). Documentation ranges 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 are safe to use in examples.
06
PUBLIC addresses are globally unique and routed on the internet, allocated via regional registries and owned by ISPs, cloud providers, and organisations.

Code & diagrams

which-kind.pypython

import ipaddress
for a in ["10.1.2.3", "172.20.0.5", "8.8.8.8", "127.0.0.1", "169.254.169.254", "100.64.1.1"]:
    ip = ipaddress.ip_address(a)
    print(f"{a:16} private={ip.is_private!s:5} loopback={ip.is_loopback!s:5} link_local={ip.is_link_local!s:5} global={ip.is_global}")

bind-address.shbash

# What address is each listening socket bound to?
ss -ltnp
# LISTEN 0 511 127.0.0.1:3000   ← reachable only from this host
# LISTEN 0 511 0.0.0.0:8080     ← reachable on every interface

Explain it without notes

A Node app in Docker listens on 127.0.0.1:3000. The port is published with -p 3000:3000, but curl localhost:3000 from the host fails. Why?

Practice

Classify: 172.32.0.1, 192.168.100.1, 169.254.10.10, 10.255.255.255, 100.70.0.1.

Trade-offs

↔
Private addressing lets every organisation reuse the same ranges, but that reuse causes overlaps when networks later need to connect (mergers, VPNs, peering). Plan unusual ranges early for anything that might be connected.

Done when you can

I can recognise RFC 1918, loopback, link-local, and CGNAT ranges on sight.
I know the difference between binding to 127.0.0.1 and 0.0.0.0.