IPAM glossary

What is RFC 1918 networks?

RFC 1918 networks are IPv4 address ranges reserved for private use that any organization can assign inside its own network without registration. They are not routed on the public internet, so reaching outside hosts requires translation such as network address translation, and the same ranges can be reused by many networks.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

RFC 1918 networks define three reserved IPv4 address ranges (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) that organizations can use internally without public registration, conserving scarce global address space for enterprises, campuses, and cloud networks. These private addresses are not routed on the public internet and require network address translation or a proxy to reach external hosts, but create operational risks when multiple networks merge or connect via VPN because the same ranges can be reused by many organizations, leading to overlapping subnets. Careful IP address management and central planning in IPAM systems are essential to prevent conflicts, duplicate assignments, and the slow, error-prone process of renumbering or adding translation to resolve address space collisions.

  • RFC 1918 comprises three non-routable IPv4 blocks—10.0.0.0/8 holding over 16 million addresses, 172.16.0.0/12, and 192.168.0.0/16—that any organization can assign internally without registry approval or global uniqueness constraints.
  • The primary operational challenge arises when organizations using identical private ranges connect through mergers, VPNs, or multi-cloud links, revealing conflicting subnets that require either renumbering or translation mechanisms to resolve.
  • Private addressing alone does not provide security; firewall rules, segmentation policies, and authoritative internal DNS resolvers for reverse zones are necessary to prevent address leakage, mitigate insider threats, and maintain accurate traffic attribution despite NAT masking.

RFC 1918 networks at a glance

AttributeValue
Categoryaddressing method
Defined inRFC 1918
Primary useAssigning IPv4 addresses to internal hosts without public registration
OSI layerLayer 3 (network)
Related termsNetwork address translation, IPv4, IP address management, CIDR, Unique local address

How RFC 1918 networks works

RFC 1918 reserves three IPv4 blocks for private use. Hosts in these blocks communicate freely inside a network, and internet access depends on how the network is connected to the outside.

The three reserved blocks are 10.0.0.0 to 10.255.255.255 (10.0.0.0/8), 172.16.0.0 to 172.31.255.255 (172.16.0.0/12), and 192.168.0.0 to 192.168.255.255 (192.168.0.0/16). Any organization can use them without asking a registry, and routers on the public internet are expected not to forward traffic to or from them. Because many networks use the same ranges, addresses are only unique within one network. To reach public destinations, a host usually goes through a gateway that performs network address translation or a proxy, which presents a public address on its behalf. When two private networks are joined, by a VPN or a merger, overlapping ranges must be resolved by renumbering or translation.

Why RFC 1918 networks matters in enterprise networks

Private addressing conserves public IPv4 space, which is scarce. RFC 1918 was published to let organizations number internal hosts without consuming globally unique addresses, and it remains the basis for most enterprise, campus and cloud virtual networks. Even a very large organization can fit its hosts inside the 10.0.0.0/8 block, which holds more than 16 million addresses.

The main operational risk is overlap. Because every organization can use the same ranges, mergers, partner connections, VPNs and multi-cloud links often reveal conflicting subnets. Fixing this means renumbering or adding translation, both of which are slow and error-prone. Without an authoritative record of which subnets are allocated, teams also create duplicate assignments and leave unused blocks untracked. Careful planning and IP address management reduce these conflicts.

For security, private addresses are not a protection by themselves. Being unroutable on the internet does not stop attacks from inside the network, from compromised hosts, or through translation and tunnels. Firewall and segmentation rules should be written deliberately, and logs that record only private addresses can be hard to attribute when translation hides the original source.

RFC 1918 networks vs Public IP address

A private RFC 1918 address is valid only inside a network and is not routed on the internet, while a public address is globally unique and reachable across the internet. What is IP Address?

AttributeRFC 1918 networksPublic IP address
UniquenessUnique only within one networkGlobally unique
RegistrationNo registry assignment neededAllocated through a regional registry or provider
Internet routingNot routed on the public internetRouted on the public internet
Outside accessNeeds translation or a proxyCan communicate directly

RFC 1918 networks vs NAT (network address translation)

RFC 1918 defines which address blocks are private, while NAT is a mechanism that rewrites addresses so private hosts can reach public destinations. What is NAT?

AttributeRFC 1918 networksNAT (network address translation)
What it isA set of reserved address rangesAn address rewriting function on a gateway
Defined byRFC 1918Separate specifications, not RFC 1918
RoleProvides internal numberingConnects internal numbering to public networks
DependenceCan be used without NAT on isolated networksCan be used with public addresses too

Common RFC 1918 networks issues

Two organizations that both use 10.0.0.0/8 or 192.168.0.0/16 often find the same subnet on both sides when they connect. Symptoms include traffic that stays local instead of crossing the link, and the fix is renumbering or translating one side.

A remote user's home network commonly uses 192.168.0.0/24 or 192.168.1.0/24, which can collide with the same corporate subnet. Routes to the office then fail or point to the local network. Multi-cloud peering fails for the same reason when virtual networks share a range.

Misconfigured filters or DNS records can expose RFC 1918 addresses to outside parties. Outsiders then see unreachable answers, or traffic sourced from private addresses appears at the edge and is dropped.

Teams that assign small or arbitrary subnets from the 10.0.0.0/8 block without a plan run out of contiguous space and cannot summarize routes. Tracking allocations in IPAM prevents this and shows conflicts before deployment.

Queries for private addresses that escape the internal network reach public resolvers, which cannot answer them usefully. This produces slow lookups and noisy logs, and internal resolvers should be authoritative for these reverse zones.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

RFC 1918 networks FAQ

Related terms

Article

NAT (network address translation)

Remapping one IP address space into another by modifying network address information in the IP header of packets while they are in transit across a traffic routing device.

Learn more
Article

IPv4 (Internet Protocol version 4)

The fourth version of Internet Protocol that uses 32-bit addresses to route most of today’s internet traffic; the global supply of IPv4 addresses is exhausted. Learn More

Learn more
Article

IPAM (IP address management)

A method for planning, tracking, and managing IP address space on a network.

Learn more
Article

CIDR (Classless Inter-Domain Routing)

A method for allocating IP addresses and IP routing introduced by the ITEF 1993 to replace classful networks.

Learn more
Article

Internet Protocol Address (IP Address)

A numerical label assigned to each device connected to a network that uses IP for communication.

Learn more
Article

Subnet mask

A 32-bit number that masks an IP address, and divides the IP address into network address and host address.

Learn more
Article

DDI (DNS, DHCP, and IPAM)

The integration of DNS, DHCP, and IPAM into one management solution.

Learn more
Article

Static IP address

An IP address that doesn’t change and was manually configured for a device, versus one that was assigned by a DHCP server.

Learn more
Browse the full glossary