Private Address Ranges and NAT

Why your VPC uses 10.x addresses

RFC 1918 reserves three IPv4 ranges for private networks: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. These addresses are not routed on the public internet, so any organisation can reuse them internally without asking anyone. Your home Wi-Fi probably uses 192.168.x.x; most cloud VPCs use 10.x.x.x because it offers the most room. A private address cannot talk to the internet directly. Instead, a device performing Network Address Translation (NAT) rewrites the source address of outgoing packets to a public address, remembers the mapping, and rewrites replies back. This is what your home router does, and in the cloud a NAT gateway plays the same role. A common slip: 172.16.0.0/12 ends at 172.31.255.255, so 172.32.0.1 is a public address. Another: because everyone reuses these ranges, two networks you later want to connect may clash, which is why address planning matters.

Which of these are private?

Python knows the special-purpose ranges, so you can sanity-check an address list.

import ipaddress

for ip in ["10.20.1.5", "172.16.8.1", "172.32.0.1", "192.168.1.10", "8.8.8.8"]:
    addr = ipaddress.ip_address(ip)
    print(f"{ip:<14} private={addr.is_private}")

Output:

10.20.1.5      private=True
172.16.8.1     private=True
172.32.0.1     private=False
192.168.1.10   private=True
8.8.8.8        private=False

Hostel room numbers

Room 101 exists in every hostel in the country, and that is fine because the number only means something inside the building. Letters leave through the warden's office, which writes the hostel's real postal address on the envelope. RFC 1918 addresses are room numbers; NAT is the warden's office.

Quick check: Which address is NOT in an RFC 1918 private range?

• 10.255.0.1
• 172.20.5.5
• 172.40.0.1
• 192.168.0.1