In the Internet addressing architecture, a private network is a network that uses private
IP address space, following the standards set by RFC 1918 for Internet Protocol Version
4, and RFC 4193 for Internet Protocol Version 6.
These addresses are commonly used for home, office, and enterprise local area networks,
when globally routable addresses are not mandatory, or are not available for the intended network
applications.
Under IPv4, the private IP address spaces were originally defined in an effort to delay
IPv4 address exhaustion, but they are also a feature of IPv6, the next generation Internet
Protocol.
These addresses are characterized as private because they are not globally delegated, meaning
that they are not allocated to any specific organization, and IP packets addressed with
them cannot be transmitted through the public Internet.
Anyone may use these addresses without approval from a regional Internet registry.
If such a private network needs to connect to the Internet, it must use either a network
address translator gateway, or a proxy server.
Private IPv4 address spaces The Internet Engineering Task Force has directed
the Internet Assigned Numbers Authority to reserve the following IPv4 address ranges
for private networks, as published in RFC 1918:
Dedicated space for Carrier Grade NAT deployments In April 2012, IANA allocated 100.64.0.0/10
for use in carrier grade NAT scenarios in RFC 6598.
This address block should not be used either on private networks or on the public Internet:
it is intended only for use within the internal operations of carrier networks.
The size of the address block was selected to be large enough to uniquely number all
customer access devices for all of a single operator's points of presence in a large metropolitan
area such as the Tokyo metropolitan area.
Private IPv6 addresses
The concept of private networks and special address reservation for such networks has
been carried over to the next generation of the Internet Protocol, IPv6.
The address block fc00::/7 has been reserved by IANA as described in RFC 4193.
These addresses are called Unique Local Addresses.
They are defined as being unicast in character and contain a 40-bit random number in the
routing prefix to prevent collisions when two private networks are interconnected.
Despite being inherently local in usage, the IPv6 address scope of unique local addresses
is global.
A former standard proposed the use of so-called "site-local" addresses in the fec0::/10 range,
but due to major concerns about scalability and the poor definition of what constitutes
a site, its use has been deprecated since September 2004 by RFC 3879.
Link-local addresses
Another type of private networking uses the link-local address range.
The validity of link-local addresses is limited to a single link; e.g. to all computers connected
to a switch, or to one wireless network.
Hosts on different sides of a bridge are also on the same link, whereas hosts on different
sides of a router are on different links.
IPv4 In IPv4, link-local addresses are codified
in RFC 6890 and RFC 3927.
Their utility is in self-autoconfiguration by network devices when Dynamic Host Configuration
Protocol services are not available and manual configuration by a network administrator is
not desirable.
The block 169.254.0.0/16 is reserved for this purpose, with the exception of the first and
the last /24 subnets in the range.
If a host on an IEEE 802 network cannot obtain a network address via DHCP, an address from
169.254.1.0 to 169.254.254.255 may be assigned pseudorandomly.
The standard prescribes that address collisions must be handled gracefully.
IPv6 In IPv6, link-local addresses are codified
in RFC 4862.
Their use is mandatory, and an integral part of the IPv6 standard.
The IPv6 addressing architecture sets aside the block fe80::/10 for IP address autoconfiguration.
Common uses The most common use of private addresses is
in residential networks, since most Internet service providers only allocate a single publicly
routable IP address to each residential customer, but many homes have more than one computer
or other Internet connected device, such as smartphones.
In this situation, a network address translator gateway is usually used to provide Internet
connectivity to multiple hosts.
Private addresses are also commonly used in corporate networks, which for security reasons,
are not connected directly to the Internet.
Often a proxy, SOCKS gateway, or similar devices are used to provide restricted Internet access
to network-internal users.
In both cases, private addresses are often seen as enhancing network security for the
internal network, since it is difficult for an Internet host to connect directly to an
internal system.
Misrouting It is common for packets originating in private
address spaces to be misrouted onto the Internet.
Private networks often do not properly configure DNS services for addresses used internally
and attempt reverse DNS lookups for these addresses, causing extra traffic to the Internet
root nameservers.
The AS112 project attempted to mitigate this load by providing special blackhole anycast
nameservers for private address ranges which only return negative result codes for these
queries.
Organizational edge routers are usually configured to drop ingress IP traffic for these networks,
which can occur either by misconfiguration, or from malicious traffic using a spoofed
source address.
Less commonly, ISP edge routers drop such egress traffic from customers, which reduces
the impact to the Internet of such misconfigured or malicious hosts on the customer's network.
Merging private networks Since the private IPv4 address space is relatively
small, many private IPv4 networks use the same address space.
This creates a common problem when merging such networks, namely the duplication of addresses
on multiple devices.
In this case, networks or hosts must be renumbered, often a time-consuming task, or a network
address translator must be placed between the networks to masquerade the duplicated
addresses.
To mitigate this problem for IPv6, RFC 4193 specifies a large unique Global ID to be pseudo-randomly
generated by each organization using Unique Global Addresses.
It is very unlikely that two network addresses generated in this way will be the same.
Private use of other reserved addresses Historically address blocks other than the
private address ranges have been reserved for potential future uses.
Some organizations have used them for private networking applications despite official warnings
of possible future address collisions.
Typically these addresses are not referred to as "reserved."
IPv4 addresses 240.0.0.0 to 254.255.255.254 are designated for future use and research
and development.
See also Heartbeat network
Intranet, a private internet Reserved IP addresses
RFC References RFC 1918 – "Address Allocation for Private
Internets" RFC 2036 – "Observations on the use of Components
of the Class A Address Space within the Internet" RFC 2050 – "Internet Registry IP Allocation
Guidelines" RFC 2101 – "IPv4 Address Behaviour Today"
RFC 2663 – "IP Network Address Translator Terminology and Considerations"
RFC 3022 – "Traditional IP Network Address Translator"
RFC 3330 – "Special-Use IPv4 Addresses" RFC 5735 – "Special-Use IPv4 Addresses"
RFC 6890 – "Special-Purpose IP Address Registries" RFC 3879 – "Deprecating Site Local Addresses"
RFC 3927 – "Dynamic Configuration of IPv4 Link-Local Addresses"
RFC 4193 – "Unique Local IPv6 Unicast Addresses" RFC 6598 – "Reserved IPv4 Prefix for Shared
Address Space" Notes
References