IP Addressing (IPv4, IPv6, Private/Public IP)

Every backend engineer eventually has to reason about how a request finds its way to a specific machine, and that starts with the IP address. Interviewers probe this to check you understand why cloud VPCs, container networking, and NAT gateways are designed the way they are — and why "just give every service a public IP" isn't how anyone actually runs infrastructure.

What Is IP Addressing?

An IP address is the unique number that identifies a device on a network, the same way a street address identifies a building — it's how data knows where to go. There are a few different flavors worth knowing:

• IPv4 — the original, shorter style of address (like 192.168.1.10); there are only about 4.3 billion of them, and we've run out.
• IPv6 — a newer, much longer style of address designed to never run out.
• Public IP — an address visible to the whole internet, like a building's street address that mail carriers everywhere can find.
• Private IP — an address that only makes sense inside one local network, like an apartment's internal unit number, invisible from outside the building.

Where This Is Used

• Your home Wi-Fi router hands out private IPs like 192.168.1.x to your phone, laptop, and smart TV, then shares one public IP with the outside internet.
• Cloud providers like AWS and Google Cloud let you design a virtual network (a VPC) where databases sit on private IPs, unreachable from the public internet, while web servers get public ones.
• Every website you visit has a public IP address behind its domain name, which is what DNS actually looks up when you type a URL.
• ISPs are increasingly rolling out IPv6 to home and mobile customers because the pool of available IPv4 addresses has run dry.

A Day-to-Day Example

Think of a large apartment building. The building itself has one public street address that mail carriers and visitors from outside use to find it. Inside, every unit has its own number — 4B, 12A — that only makes sense within that building; a delivery driver from another city has no use for "4B" without the building's street address first. Public and private IPs work the same way: a private IP only makes sense inside its own network, and needs the network's shared public IP to be reachable from the outside world.

Deep Dive: IPv4 Structure — 32 Bits, Four Octets

An IPv4 address is a single 32-bit number. Humans read it as four 8-bit octets separated by dots, but the machine sees one continuous binary string:

192.168.1.10
= 11000000 . 10101000 . 00000001 . 00001010
    192          168         1          10
  (8 bits)     (8 bits)   (8 bits)   (8 bits)   = 32 bits total

Max value per octet: 255 (11111111)
Total address space: 2^32 = 4,294,967,296 addresses

That ~4.3 billion number sounds huge until you remember every phone, laptop, server, router, and IoT device on Earth wants one — which is exactly why the address space ran out (IANA allocated the last free IPv4 blocks back in 2011) and why private addressing plus NAT became load-bearing infrastructure rather than a workaround.

Deep Dive: IPv6 — Why 128 Bits, and What the Address Actually Looks Like

2001:0db8:85a3:0000:0000:8a2e:0370:7334
= 8 groups of 16 bits, written in hex, separated by colons
= 128 bits total = 2^128 addresses (≈ 3.4 × 10^38)

Shortened form (leading zeros dropped, one run of zero groups collapsed to ::):
2001:db8:85a3::8a2e:370:7334

128 bits wasn't picked arbitrarily — it gives every device, everywhere, essentially unlimited unique addressing, removing the scarcity that made NAT necessary in the first place. IPv6 also folds in features IPv4 needed extra protocols for: built-in autoconfiguration (SLAAC), no more fragmentation by routers in transit, and a simpler, fixed-size header for faster router processing.

Deep Dive: Private vs Public — The Three RFC 1918 Ranges

10.0.0.0/8       10.0.0.0    - 10.255.255.255   (~16.7M addresses)
172.16.0.0/12    172.16.0.0  - 172.31.255.255    (~1.05M addresses)
192.168.0.0/16   192.168.0.0 - 192.168.255.255   (~65K addresses)

Your laptop:  192.168.1.20   (private — only valid on your LAN)
Your router's WAN side: 49.x.x.x  (public — globally routable)
                          ^ NAT translates between the two

Private ranges are reserved by RFC 1918 specifically so they're never routed on the public internet — every ISP and backbone router silently drops packets addressed to them from outside. That's what makes it safe for millions of unrelated home networks and corporate LANs to all reuse 192.168.1.0/24 internally without ever colliding: they're only unique within their own routing domain.

Key Pointers

• IPv4 addresses are 32-bit, written as four dotted decimal octets (e.g. 192.168.1.10), giving ~4.3 billion possible addresses — long since exhausted.
• IPv6 addresses are 128-bit, written as eight groups of hex digits (e.g. 2001:db8::1), providing an effectively unlimited address space and built-in support for autoconfiguration.
• Private IP ranges (RFC 1918) are reserved for internal networks and never routed on the public internet: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
• A public IP is globally unique and routable on the internet; a private IP is only meaningful within its own local network and requires NAT to reach the outside world.
• MAC address = link-layer local identity (burned into the NIC); IP address = network-layer logical address (assigned, routable); Port = the application/service endpoint reachable at that IP. These are three separate identity concepts at three separate layers — don't conflate them.
• IPv6 exists primarily to solve address exhaustion, but it also simplifies routing tables and removes the practical need for NAT — though NAT is still used in some IPv6 deployments for other reasons (e.g. renumbering avoidance).

How It Works

1. A device requests an IP address via DHCP (or is assigned a static one), scoped to its local network's address range.
2. If the address falls in a private range, it can only communicate directly with other devices on the same private network.
3. To reach the internet, private-IP traffic is translated to the network's public IP by a NAT gateway or router.
4. DNS resolves human-readable domain names to the actual IP address (IPv4 A record or IPv6 AAAA record) the client should connect to.
5. Routers along the path use the destination IP's network portion to forward packets hop by hop toward the destination.

Try It Yourself

# Check your machine's private IP:
ifconfig          # macOS/Linux (legacy)   or: ip addr        # Linux

# Check your public IP as seen by the internet:
curl ifconfig.me
curl -s https://api.ipify.org

# Resolve a domain's IPv4 (A) and IPv6 (AAAA) records:
dig example.com A
dig example.com AAAA

# See the full path (and each hop's IP) from you to a destination:
traceroute example.com     # or: mtr example.com (live, continuous)

# Confirm a private IP is unroutable off your LAN:
ping 192.168.1.1           # works locally
ping 192.168.1.1 (from a different network) # times out / unreachable

Interview Q&A

Q: Why do we still use private IP ranges and NAT instead of just switching everyone to IPv6?

A: Migration cost and inertia. IPv4 is embedded in decades of hardware, software, and ISP infrastructure; dual-stack support is inconsistent, and most networks work fine today with private addressing plus NAT, so there's no forcing function to migrate. IPv6 adoption is real but gradual — many systems run dual-stack (both IPv4 and IPv6) for years during transition.

Q: Can two different private networks use the exact same private IP address?

A: Yes — that's the entire point of a private range. Private IPs only need to be unique within their own routing domain (e.g. your home LAN, or one company's VPC). Two unrelated home networks can both have a device at 192.168.1.10 with zero conflict, because neither address is ever visible or routable outside its own local network.

Q: Is a private IP address "more secure" than a public one?

A: Not inherently — that's a common misconception. Private addressing is about routability, not security. A private IP just means the address isn't globally routable, which incidentally makes unsolicited inbound internet traffic harder to reach it (since there's no route), but it's not an access-control mechanism. You still need firewalls, security groups, and authentication for real security — plenty of internal traffic between private IPs still needs encryption and authorization.

System Design Tie-in

Designing a VPC for a multi-tier app (web tier, app tier, database tier) starts with IP addressing decisions: public subnets hold instances with public IPs (or behind a load balancer that has one) for internet-facing traffic; private subnets hold app servers and databases with only private IPs, reachable via NAT gateway for outbound calls but never directly from the internet. This is the concrete mechanism behind "put your database in a private subnet" — it's not a policy, it's literally that the database has no public IP and no route from the internet exists to it.

Trade-offs

IPv4 is still dominant because of backward compatibility and the sheer cost of migrating existing infrastructure, even though its address space ran out years ago — which is precisely why NAT and private ranges became load-bearing infrastructure rather than an edge case. IPv6 removes the NAT requirement and simplifies peer-to-peer connectivity, but adoption lags because dual-stack support, tooling, and ISP rollout are inconsistent. A common interview gotcha: confusing "private IP" with "insecure" — private addressing is about routability, not security, and plenty of internal traffic still needs encryption and access control.