IP Addressing Explained: Public vs Private, Subnetting & Interview Questions

Built for people who are learning networking the real way: by breaking stuff, fixing it, and doing it again.

---

IP Addressing in One Paragraph

An IPv4 address is a 32-bit number written as four octets, such as 192.168.1.100. Part of it identifies the network and the rest identifies the host on that network, and the prefix length (the /24 in 192.168.1.100/24, also written as the subnet mask 255.255.255.0) says where the split falls. Private addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, defined in RFC 1918) are used inside your own networks and reach the internet through NAT. Public addresses are globally unique and routable. A handful of other ranges have special jobs: 127.0.0.0/8 for loopback, 169.254.0.0/16 for self-assigned addresses when DHCP fails, and 100.64.0.0/10 for carrier-grade NAT. IPv6 uses 128-bit addresses, gives every LAN a /64, and has its own link-local (fe80::/10) and private (fd00::/8) ranges.

That covers what most cert exams and interviews test at the fundamentals level. The rest of this guide explains each piece, gives you worked subnetting examples you can check yourself, shows the commands to see all of it on your own machine, and lists the problems you will actually hit. It is aimed at career changers, people studying for CCNA, Network+ or AZ-900, and anyone wiring up a home lab.

When you want to try ranges yourself, our free subnet calculator does the arithmetic for any address and prefix.

---

Cheat Sheet: IPv4 and IPv6 Address Ranges

Bookmark this table. Every range is from the IANA special-purpose registries for IPv4 and IPv6, with the defining RFC linked.

Range	Subnet mask	Addresses	Purpose	Defined in
10.0.0.0/8	255.0.0.0	16,777,216	Private (10.0.0.0 to 10.255.255.255)	RFC 1918
172.16.0.0/12	255.240.0.0	1,048,576	Private (172.16.0.0 to 172.31.255.255)	RFC 1918
192.168.0.0/16	255.255.0.0	65,536	Private (192.168.0.0 to 192.168.255.255)	RFC 1918
100.64.0.0/10	255.192.0.0	4,194,304	Shared address space for carrier-grade NAT (100.64.0.0 to 100.127.255.255)	RFC 6598
127.0.0.0/8	255.0.0.0	16,777,216	Loopback (127.0.0.1 is “localhost”)	RFC 1122
169.254.0.0/16	255.255.0.0	65,536	Link-local / APIPA (self-assigned when DHCP fails)	RFC 3927
0.0.0.0/8	255.0.0.0	16,777,216	“This network”; 0.0.0.0 means “any address” when a service binds to it	RFC 1122
192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24	255.255.255.0	256 each	Documentation and examples only, never routed	RFC 5737
224.0.0.0/4	240.0.0.0	268,435,456	Multicast (old “Class D”)	RFC 5771
240.0.0.0/4	240.0.0.0	268,435,456	Reserved (old “Class E”); 255.255.255.255 is limited broadcast	RFC 6890
::1/128	n/a	1	IPv6 loopback	RFC 4291
fe80::/10	n/a	n/a	IPv6 link-local (every IPv6 interface has one)	RFC 4291
fc00::/7 (in practice fd00::/8)	n/a	n/a	IPv6 Unique Local Addresses, the IPv6 equivalent of private ranges	RFC 4193
2000::/3	n/a	n/a	IPv6 global unicast (public)	RFC 4291
2001:db8::/32	n/a	n/a	IPv6 documentation	RFC 3849

---

What is an IP Address?

An IP address is the number a device uses to send and receive traffic on an IP network. Think of it as a postal address for devices: when your PC wants to send something to a printer or a website, it needs to know where to send it, and that “where” is an IP address.

Strictly, addresses belong to interfaces, not devices. A laptop with Wi-Fi and Ethernet has two, a server running Docker may have a dozen, and every machine also has a loopback address for talking to itself.

Most of this guide covers IPv4, because it is still what you see first in home networks, small offices and fundamentals exams. IPv6 has its own section further down, and you should expect to work with both.

Important mindset

An IP address on its own is only half the story. With its prefix length, it answers two questions:

1. Which network is this device on?
2. Which device is it on that network?

Your machine uses the answer to the first question constantly. When it sends a packet, it checks whether the destination is on its own network. If it is, it delivers directly (finding the MAC address with ARP). If it isn’t, it sends the packet to its default gateway, usually your router. Getting the mask wrong breaks exactly this decision, which is why a wrong mask produces such confusing symptoms.

---

Subnet Masks and CIDR Notation

The subnet mask marks which bits are network and which are host. 255.255.255.0 in binary is 24 ones followed by 8 zeros, so the first 24 bits are network. CIDR notation (Classless Inter-Domain Routing, RFC 4632) writes the same thing as /24: the number of network bits.

The number of addresses in a subnet is 2 to the power of the host bits. In a normal subnet, two of those can’t be given to hosts: the first is the network address and the last is the broadcast address. So usable hosts = 2^{(32 − prefix)} − 2.

Prefix	Subnet mask	Total addresses	Usable hosts	Typical use
/8	255.0.0.0	16,777,216	16,777,214	The whole 10.x private block
/16	255.255.0.0	65,536	65,534	Cloud VNet/VPC address space, large campus
/20	255.255.240.0	4,096	4,094	Large cloud subnet
/22	255.255.252.0	1,024	1,022	Big office floor, Wi-Fi for many clients
/23	255.255.254.0	512	510	Medium office
/24	255.255.255.0	256	254	Home network, most VLANs
/25	255.255.255.128	128	126	Half a /24
/26	255.255.255.192	64	62	Small VLAN (servers, IoT)
/27	255.255.255.224	32	30	Small server or management VLAN
/28	255.255.255.240	16	14	Small DMZ, block of public IPs from an ISP
/29	255.255.255.248	8	6	Small public IP block
/30	255.255.255.252	4	2	Point-to-point link (traditional)
/31	255.255.255.254	2	2	Point-to-point link, no network/broadcast (RFC 3021)
/32	255.255.255.255	1	1	A single host (firewall rules, loopbacks, routes)

Cloud platforms take a few more. Azure reserves five addresses in every subnet (the network address, the first three hosts for the gateway and DNS, and the broadcast address), so a /24 in Azure gives you 251 usable addresses, not 254. The Azure Virtual Network FAQ lists them. AWS VPC subnets also reserve five.

---

Worked Subnetting Examples

Every answer below was checked with Python’s ipaddress module, and you can check them the same way (see the snippet after the examples) or in our subnet calculator.

The block-size shortcut

For prefixes between /25 and /30, subtract the last non-255 octet of the mask from 256 to get the block size. Subnets start at multiples of the block size. For /26 (mask 255.255.255.192), 256 − 192 = 64, so the subnets in the last octet start at 0, 64, 128 and 192. The same trick works in the third octet for /17 to /23.

Example 1: Which subnet is 192.168.1.100/26 in?

• Block size is 64. The multiple of 64 at or below 100 is 64.
• Network: 192.168.1.64/26
• Broadcast: one below the next block (128), so 192.168.1.127
• Usable hosts: 192.168.1.65 to 192.168.1.126, 62 hosts

So 192.168.1.100/26 and 192.168.1.130/26 look like neighbours but sit in different subnets. They need a router between them, which surprises people the first time.

Example 2: Split 192.168.1.0/24 into four equal subnets

Four subnets need 2 extra network bits (2² = 4), so /24 becomes /26:

Subnet	Usable range	Broadcast
192.168.1.0/26	.1 to .62	.63
192.168.1.64/26	.65 to .126	.127
192.168.1.128/26	.129 to .190	.191
192.168.1.192/26	.193 to .254	.255

A home lab could use these as users, servers, IoT and management.

Example 3: A subnet that crosses the third octet, 10.20.3.77/22

• /22 has mask 255.255.252.0. The interesting octet is the third: 256 − 252 = 4, so blocks start at 0, 4, 8 and so on.
• 3 falls in the block starting at 0.
• Network: 10.20.0.0/22; broadcast: 10.20.3.255
• Usable: 10.20.0.1 to 10.20.3.254, 1,022 hosts

Note that 10.20.1.0 and 10.20.2.255 are perfectly normal host addresses inside this subnet. Only the very first and very last addresses of the whole /22 are special.

Example 4: Size a subnet for 50 devices

Find the smallest prefix whose usable host count is at least 50. A /27 gives 30, too small. A /26 gives 62, which fits with room to grow. If you expect to grow past 62, pick a /25 (126) now: renumbering later is far more work than a slightly bigger subnet today.

Example 5: Point-to-point links, /30 or /31

A link between two routers needs exactly two addresses. A /30 (for example 10.0.0.0/30) has four addresses: network .0, hosts .1 and .2, broadcast .3. A /31 (10.0.0.0/31) uses both addresses, .0 and .1, as hosts, because RFC 3021 drops the network and broadcast addresses on point-to-point links. Most current router operating systems support /31s; check yours before using them.

Check your own answers

Python ships with everything you need, on any OS:

python3 - <<'EOF'
import ipaddress
iface = ipaddress.ip_interface("192.168.1.100/26")
net = iface.network
hosts = list(net.hosts())
print("Network:  ", net)
print("Netmask:  ", net.netmask)
print("Broadcast:", net.broadcast_address)
print("Usable:   ", hosts[0], "-", hosts[-1], f"({len(hosts)} hosts)")
print("Private?  ", iface.ip.is_private)
EOF

Output:

Network:   192.168.1.64/26
Netmask:   255.255.255.192
Broadcast: 192.168.1.127
Usable:    192.168.1.65 - 192.168.1.126 (62 hosts)
Private?   True

Change the address and prefix to check any example. The ipaddress documentation also covers subnets() for splitting a range and supernet() for combining one. On Debian and Ubuntu, the ipcalc package (sudo apt install ipcalc) gives a similar summary from the command line.

---

Public vs Private IP Addresses

This part confuses almost everyone at first. After this section, it won’t.

Private IP addresses

Private IP addresses are for use inside networks you control: your home network, your office LAN, your lab, your cloud VNets. RFC 1918 reserves three ranges:

Range	CIDR	Subnet mask	Old class it falls in
10.0.0.0 to 10.255.255.255	10.0.0.0/8	255.0.0.0	A
172.16.0.0 to 172.31.255.255	172.16.0.0/12	255.240.0.0	B
192.168.0.0 to 192.168.255.255	192.168.0.0/16	255.255.0.0	C

The 172 range catches people out: 172.16.x.x to 172.31.x.x is private, but 172.32.0.1 is a public address. And the mask in the table describes the whole reserved block. Inside it you can use any smaller subnet you like, which is why a home network on 192.168.1.0/24 is normal.

Private addresses are not routed on the internet, so millions of networks can reuse the same ranges without conflict. My house can use 192.168.1.x, your house can too, and that is fine. The conflicts only start when two private networks have to be joined, by a VPN for example (see Troubleshooting).

Public IP addresses

A public IP address is globally unique and routable on the internet. Your ISP assigns one (or, increasingly, shares one; see CGNAT below) to your router’s WAN side, and that is what websites see when you connect.

In this guide, public examples use 203.0.113.22. That comes from a range RFC 5737 sets aside for documentation, so it can never belong to anyone real. Whenever you write docs, tickets or blog posts, use these ranges for example addresses too.

Your machine therefore has two identities when it browses:

• A private IP on its own interface (for example 192.168.1.100), which you see with ip addr or ipconfig
• The router’s public IP (for example 203.0.113.22), which you see by searching “what is my IP” or running curl -4 https://ifconfig.me

Why do we have both?

Because IPv4 ran out. 32 bits gives about 4.3 billion addresses, fewer than the number of phones alone, and the regional internet registries exhausted their general pools years ago. Private ranges plus NAT let one public address serve a whole house or office.

NAT (Network Address Translation), briefly

Your router does NAT, specifically port address translation, which lets many private addresses share one public one:

1. Your laptop 192.168.1.100 opens a connection to readthemanual.co.uk from source port 51000.
2. The router rewrites the source to its public IP, 203.0.113.22, with a port of its choosing, and records the mapping.
3. The website replies to 203.0.113.22 on that port.
4. The router looks up the mapping and forwards the reply to 192.168.1.100 port 51000.

To the internet, everything in your house comes from one address. The side effect is that unsolicited inbound connections have no mapping to follow, which is why hosting something at home needs a port forward.

CGNAT and 100.64.0.0/10: when your router doesn’t have a public IP either

Many ISPs, especially mobile, 4G/5G home broadband and some fibre providers, put customers behind carrier-grade NAT: the ISP does a second layer of NAT and your router’s WAN gets an address from 100.64.0.0/10 (100.64.0.0 to 100.127.255.255), the shared address space defined in RFC 6598. It isn’t one of the RFC 1918 ranges; it exists so ISPs have room that won’t clash with the private ranges customers use at home.

How to tell if you’re behind CGNAT: look at the WAN or internet IP on your router’s status page and compare it with what “what is my IP” reports. If the router shows 100.64.x.x to 100.127.x.x (or any private address) and the two differ, there is NAT upstream of you. The practical consequence is that port forwarding on your router won’t work for inbound connections, because the ISP’s NAT has no forward for you. The usual fixes are asking the ISP for a public IPv4 (sometimes a paid add-on), using IPv6, or using an outbound tunnel or overlay VPN.

You will also see 100.x addresses on overlay VPNs. Tailscale, for example, gives each device an address from 100.64.0.0/10 because it rarely clashes with home or office ranges (Tailscale’s explanation).

---

IP Address Classes (and Why They’re History)

Before 1993, IPv4 was classful: the first bits of an address fixed the size of its network. CIDR replaced this, and routers today ignore classes entirely. You still need to know them because exams ask, people say “a Class C”, and they explain the default masks you will see in old kit.

Class	First octet range	Leading bits	Default subnet mask	Use
A	1 to 126	0	255.0.0.0 (/8)	Very large networks
B	128 to 191	10	255.255.0.0 (/16)	Medium networks
C	192 to 223	110	255.255.255.0 (/24)	Small networks
D	224 to 239	1110	n/a	Multicast
E	240 to 255	1111	n/a	Reserved / experimental

0 and 127 are left out of Class A because 0.0.0.0/8 means “this network” and 127.0.0.0/8 is loopback. In a modern network, the class tells you nothing about the actual subnet size: 10.1.2.0/24 is a perfectly normal “Class A” address in a /24 subnet. When someone says “Class C”, they nearly always just mean “a /24”.

---

Special IP Addresses

Some addresses aren’t for normal hosts. These are the ones you will meet in troubleshooting.

127.0.0.1 (localhost)

127.0.0.1 is the loopback address, also called localhost. The whole 127.0.0.0/8 block loops back, though 127.0.0.1 is the one you use. Traffic to it never leaves the machine. Use it to test services running locally (a web server, a database) and to check the TCP/IP stack is alive. The IPv6 equivalent is ::1.

A common gotcha: a service bound to 127.0.0.1 is only reachable from the same machine. If you can reach it locally but not from another device, check what address it is listening on with ss -tln (Linux) or netstat -an (Windows).

0.0.0.0

Means “no specific address”, and the meaning depends on context:

• A service bound to 0.0.0.0 listens on every IPv4 interface.
• A route to 0.0.0.0/0 is the default route: anything not matched by a more specific route goes to the default gateway.
• A DHCP client uses 0.0.0.0 as its source address before it has one.

255.255.255.255 and subnet broadcasts

255.255.255.255 is the limited broadcast address: “everyone on this local network”. DHCP uses it, because a new client doesn’t know its subnet yet. Each subnet also has its own directed broadcast, the last address in the range, such as 192.168.1.255 in 192.168.1.0/24. You don’t assign either to a device.

169.254.x.x (APIPA / link-local)

If you see something like 169.254.12.54, the device asked for an address via DHCP, got no answer, and gave itself a link-local address (Microsoft calls it APIPA, Automatic Private IP Addressing). RFC 3927 has the device pick a random address between 169.254.1.0 and 169.254.254.255 and check no one else is using it.

Devices with 169.254 addresses can talk to each other on the same segment, which is occasionally useful for direct cable connections, but they have no gateway and no internet. You’ll see this when:

• The DHCP server is down or its pool is full.
• The cable or switch port is faulty, or the port is on the wrong VLAN.
• Wi-Fi associated but authentication or DHCP failed.

Network address vs broadcast address

In every normal subnet, the first address is the network address (in 192.168.1.0/24, that’s 192.168.1.0) and the last is the broadcast address (192.168.1.255). They describe the subnet and aren’t assigned to hosts, which is why a /24 has 254 usable addresses, not 256. The exception is /31 and /32, covered above.

---

How to See Your IP Address, Mask and Gateway

Linux: ip addr and ip route

The ip command from iproute2 replaces the older ifconfig and route, which many distributions no longer install by default. The brief form is the quickest overview:

ip -br addr

Representative output (your interface names and addresses will differ):

lo               UNKNOWN        127.0.0.1/8 ::1/128
eth0             UP             192.168.1.50/24 fe80::be24:11ff:fe90:a0f7/64
docker0          UP             172.17.0.1/16

Each address is shown with its prefix, so 192.168.1.50/24 tells you both the address and the mask (255.255.255.0). The fe80:: address is the interface’s IPv6 link-local address, present even if you have no IPv6 from your ISP. The full form, ip addr show dev eth0, adds the MAC address, the broadcast address (brd) and the address scope (global or link).

Now the routing table:

ip route

default via 192.168.1.1 dev eth0 proto dhcp src 192.168.1.50 metric 100
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.50 metric 100

Read it as: anything in 192.168.1.0/24 is delivered directly on eth0; anything in 172.17.0.0/16 goes to Docker’s bridge; everything else goes to the default gateway, 192.168.1.1. To ask the kernel which route it would use for a particular destination:

ip route get 1.1.1.1

1.1.1.1 via 192.168.1.1 dev eth0 src 192.168.1.50 uid 1000
    cache

Full options are in the ip-address and ip-route manual pages. On macOS, use ifconfig and netstat -rn.

Windows: ipconfig

ipconfig

Representative output for a wired adapter:

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : home
   Link-local IPv6 Address . . . . . : fe80::1c2d:3e4f:5a6b:7c8d%12
   IPv4 Address. . . . . . . . . . . : 192.168.1.100
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.1.1

ipconfig /all adds the MAC address, DHCP server, lease times and DNS servers. ipconfig /release and ipconfig /renew drop and re-request a DHCP lease, which is the first thing to try after fixing a DHCP problem. In PowerShell, Get-NetIPAddress -AddressFamily IPv4 and Get-NetRoute give the same information as objects you can filter. Microsoft documents every switch on the ipconfig reference page.

Your public IP

# IPv4 public address as the internet sees it
curl -4 https://ifconfig.me

# IPv6, if you have it
curl -6 https://ifconfig.me

Compare the IPv4 result with your router’s WAN address to check for CGNAT, as described above.

---

Static vs Dynamic IP Addresses

Dynamic IP (DHCP)

Most devices get their address automatically from DHCP (Dynamic Host Configuration Protocol). The exchange is four messages, remembered as DORA:

1. Discover: the client broadcasts “is there a DHCP server out there?”
2. Offer: the server offers an address, mask, gateway and DNS servers.
3. Request: the client asks for the offered address.
4. Acknowledge: the server confirms, with a lease time.

Dynamic addressing suits phones, laptops, guest devices and anything that doesn’t need a predictable address.

Static IP

A static IP address is set manually and doesn’t change. You give the device four things: address (192.168.1.50), mask (255.255.255.0 or /24), gateway (192.168.1.1) and DNS servers.

Use static or reserved addresses for things you need to reach at the same address every time:

• Home lab servers (Proxmox host, TrueNAS, controllers)
• Printers (so scanning doesn’t break)
• Cameras / NVR
• Routers, firewalls, switches, access points
• Your DNS server, if you run one such as Pi-hole

How to assign static IPs in practice

Option 1: Set it on the device. Choose “Manual” or “Static” in the network settings (or use Netplan on Ubuntu Server, or nmcli on NetworkManager systems) and enter the four values. Pick an address outside the router’s DHCP pool, or you will eventually get a conflict.

Option 2: DHCP reservation. Tell the DHCP server: “when the device with MAC address AA:BB:CC:DD:EE:FF asks, always give it 192.168.1.50“. You get static behaviour while still managing everything centrally, and changing DNS servers later is one edit on the router instead of a visit to every device.

Home lab tip:
Put core gear (like your hypervisor or storage box) on reserved IPs. You’ll thank yourself at 2am when something’s offline and you need to get back into Proxmox or TrueNAS without guessing the address.

---

Why Subnetting Matters

A subnet is a smaller network carved out of a bigger range. You split networks for three reasons:

1. Organisation: servers on 192.168.10.0/24, users on 192.168.20.0/24. You know what you’re looking at from the address alone.
2. Security: traffic between subnets must pass through a router or firewall, where you can filter it. That is how you keep “IoT junk” away from “work laptop”.
3. Efficiency: broadcasts stay inside their subnet, so smaller subnets mean less noise.

In practice, each subnet usually maps to a VLAN on your switches, and the router or firewall has an interface (or sub-interface) in each. In the cloud, the same thinking applies to VNets and VPCs: you choose an address space and carve it into subnets per tier.

Example: small office addressing plan

Subnet	VLAN	Purpose	Gateway
192.168.10.0/24	10	Staff PCs	192.168.10.1
192.168.20.0/26	20	Servers	192.168.20.1
192.168.30.0/24	30	Guest Wi-Fi (internet only)	192.168.30.1
192.168.99.0/27	99	Switch and AP management	192.168.99.1

Guests reach the internet but not the servers, servers can be firewalled to the ports they serve, and management interfaces are only reachable from an admin subnet. Matching the VLAN number to the third octet is a common convention that makes the plan easier to remember.

---

IPv6 Basics You Need Now

IPv6 addresses are 128 bits, written as eight groups of four hex digits separated by colons, such as 2001:db8:0:0:0:0:0:1. Two shortening rules apply: leading zeros in a group can be dropped, and one run of all-zero groups can be replaced with ::, so that address becomes 2001:db8::1. The addressing architecture is RFC 4291.

• Every LAN is a /64. The first 64 bits are the network prefix and the last 64 identify the interface. Stateless address autoconfiguration (SLAAC, RFC 4862) relies on this, so don’t subnet a LAN smaller than /64. There is no “how many hosts fit” question in IPv6: a /64 holds 2⁶⁴ addresses.
• Your ISP delegates a bigger prefix, typically a /56 (256 LANs) or a /48 (65,536 LANs), and your router hands out /64s from it. RIPE’s best-practice document RIPE-690 recommends that ISPs give customers a /48 or /56.
• Link-local, fe80::/10: every IPv6 interface configures one automatically. It only works on the local link, and neighbour discovery and routing protocols use it. When you see fe80::...%12 on Windows or fe80::...%eth0 on Linux, the part after % is the zone ID: which interface to use, because every interface has the same fe80::/64 prefix.
• Unique Local Addresses, fd00::/8: the IPv6 counterpart of private ranges. RFC 4193 reserves fc00::/7; with the “L” bit set, which is all that is defined today, prefixes start fd, followed by a random 40-bit global ID so two networks are unlikely to clash if they are ever joined. Example: fd12:3456:789a::/48.
• Global unicast, 2000::/3: public, internet-routable addresses. Most start with 2.
• Loopback is ::1, and there is no broadcast in IPv6: multicast does that job.

The big mindset shift: IPv6 normally has no NAT. Devices get public addresses, and the protection that NAT gave you by accident comes from your router’s firewall instead, which by default should block unsolicited inbound traffic. Check that it does.

---

Practical Exercises

Do these on your own network; they take a few minutes and stick far better than reading.

1. Find your address, mask and gateway. Run ip -br addr and ip route (Linux) or ipconfig (Windows). Write down the network address of your subnet.
2. Find your public IP with curl -4 https://ifconfig.me and compare it with your router’s WAN address. Are you behind CGNAT?
3. Classify these addresses as private, public, CGNAT, link-local or documentation: 10.23.5.7, 172.20.10.4, 172.32.0.1, 100.70.1.2, 169.254.12.54, 203.0.113.10, fe80::1, fd12:3456:789a::1. (Answers: private, private, public, CGNAT, link-local, documentation, IPv6 link-local, IPv6 ULA.)
4. Subnet by hand, then check: what are the network, broadcast and usable range of 192.168.50.77/27? Work it out with the block-size method, then confirm with the Python snippet or the subnet calculator. (Answer: network 192.168.50.64, broadcast 192.168.50.95, hosts .65 to .94.)
5. Plan a lab: carve 10.10.0.0/22 into four /24s for users, servers, IoT and management, and write down the gateway for each.

---

Common Troubleshooting

Networking breaks. Here’s how to read what the network is telling you, starting from the error you actually see.

“Windows has detected an IP address conflict”

Two devices have the same IP. The classic cause: you set your NAS to 192.168.1.50 by hand, inside the router’s DHCP pool, and DHCP later handed .50 to a laptop.

Fix: move static addresses outside the DHCP pool, or replace them with DHCP reservations. To find the other device, check the router’s DHCP lease table, or run ip neigh (Linux) or arp -a (Windows) and look up the MAC address against .50.

You’ve got a 169.254.x.x address

No DHCP server answered. Check that the router or DHCP server is up and its pool isn’t exhausted, the cable and switch port, that the port is on the right VLAN, and that you joined the right SSID. Then run ipconfig /renew (Windows) or reconnect the interface. If several devices get 169.254 addresses at once, the DHCP server is the problem, not the devices.

“Destination Host Unreachable” or “Network is unreachable”

These mean different things. connect: Network is unreachable on Linux means your machine has no route to that destination: usually no default gateway (check ip route for a default via line). “Destination Host Unreachable” from ping usually means the destination is believed to be on your local subnet but nothing answered ARP for it: the host is off, unplugged or on a different subnet than you think.

Can reach the gateway but not another subnet, or vice versa

Work outwards: ping 127.0.0.1, then your own IP, then the gateway, then something beyond it by IP (1.1.1.1), then by name. The first step that fails tells you the layer. If the gateway answers but another internal subnet doesn’t, check the firewall rules between subnets and whether the far side has a route back. If IPs work but names don’t, it is DNS, not addressing.

Wrong subnet mask

A device with 255.255.0.0 on a /24 network thinks far more addresses are local than really are, so it tries ARP for hosts that are actually behind the router and fails. A device with too small a mask sends local traffic to the gateway. Symptoms are odd and partial: some hosts reachable, others not. Compare the mask with every other device on the segment.

VPN connects but you can’t reach anything: overlapping subnets

If your home network and the remote network both use 192.168.1.0/24, your machine sends traffic for the remote 192.168.1.20 out of your local interface, because a directly connected route wins. The same happens between a homelab and a cloud VNet with the same range. Plan unique ranges per site before you connect them; it is far easier than renumbering later.

Docker networks clash with your LAN or VPN

Docker’s default bridge uses 172.17.0.0/16, and each new Compose network takes another range from Docker’s default pools, which include more of 172.16.0.0/12 and 192.168.0.0/16. If your office or VPN uses one of those ranges, the host routes that traffic into a Docker bridge instead. Set your own pools in /etc/docker/daemon.json with "bip" for the default bridge and "default-address-pools" for new networks; both are documented in the dockerd reference. Existing networks keep their old ranges until you recreate them.

Port forwarding set up correctly but nothing gets in

Check for CGNAT first (router WAN address in 100.64.0.0/10, or different from your public IP). If you are behind CGNAT, no amount of router configuration will fix it; see the CGNAT section above for the options.

---

IP Addressing Interview Questions

These come up in helpdesk, sysadmin, network and cloud interviews. Answer with the reasoning, not just the fact.

“What are the private IP ranges?” 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, from RFC 1918. Bonus points for mentioning that 172.16.0.0/12 ends at 172.31.255.255, and that 100.64.0.0/10 is ISP shared space for CGNAT, not RFC 1918.

“How many usable hosts in a /26?” 2⁶ = 64 addresses, minus network and broadcast, so 62. In Azure it would be 59, because Azure reserves five addresses per subnet.

“A user has a 169.254 address. What does that tell you?” DHCP failed. The machine self-assigned a link-local address, so the problem is between the client and the DHCP server: cable, switch port, VLAN, Wi-Fi authentication or the DHCP server itself.

“Two hosts are on 192.168.1.10/25 and 192.168.1.200/25. Can they talk directly?” No. A /25 splits the last octet at 128, so they are in 192.168.1.0/25 and 192.168.1.128/25, different subnets that need a router.

“What does a default gateway do?” It is the router a host sends traffic to for any destination outside its own subnet. Wrong or missing gateway: local traffic works, everything else fails.

“How is IPv6 different, beyond the length?” Every LAN is a /64, addresses can be self-configured with SLAAC, there is no broadcast, every interface has a link-local fe80:: address, and NAT is normally not used, so the firewall does the protecting.

---

Conclusion & Next Steps

You should now be able to look at 192.168.1.100/26 and say: private (RFC 1918), in subnet 192.168.1.64/26, 62 usable hosts, broadcast .127, reaches the internet through NAT. You can spot CGNAT, APIPA and loopback addresses on sight, find all of this on your own machine with ip or ipconfig, and you know the IPv6 ranges you will meet first.

From here, two next steps:

1. Practise subnetting until it is quick. Use the block-size method, check yourself with the Python snippet or the subnet calculator, and design an addressing plan for your own lab with separate subnets for users, servers, IoT and management.
2. Learn the OSI model. You’ll hear “that’s a Layer 3 problem” or “it’s not DNS”. IP addressing is Layer 3, and knowing the layers gives you a shared language with other engineers and a faster troubleshooting order.

This is how you go from “I followed a YouTube tutorial” to actually designing networks. From lab to leader.

Related Guides

If you found this useful, these guides continue the journey:

• Network Troubleshooting Commands — put your addressing knowledge into practice
• Subnet Calculator — a practical tool for planning your networks
• Azure Virtual Networks — see IP addressing in action in the cloud
• WireGuard VPN Setup — networking fundamentals applied to VPN configuration
• Build Your First Homelab — put this knowledge into practice

Frequently Asked Questions

What are the private IP address ranges?

RFC 1918 reserves three IPv4 ranges for private networks: 10.0.0.0/8 (10.0.0.0 to 10.255.255.255), 172.16.0.0/12 (172.16.0.0 to 172.31.255.255) and 192.168.0.0/16 (192.168.0.0 to 192.168.255.255). They are not routed on the internet and reach it through NAT. The IPv6 equivalent is Unique Local Addresses in fd00::/8.

What is the difference between a public and a private IP address?

A public IP address is globally unique and routable on the internet. A private IP address only works inside your own network, can be reused by anyone, and is translated to a public address by NAT on the way out. A typical home router has one public IP on its WAN side and hands out private IPs, such as 192.168.1.x, to devices inside.

What is the 100.64.0.0/10 range?

100.64.0.0/10 (100.64.0.0 to 100.127.255.255) is shared address space for carrier-grade NAT, defined in RFC 6598. ISPs use it between their NAT and customers’ routers. If your router’s WAN address is in this range, you are behind CGNAT and inbound port forwarding will not work. Overlay VPNs such as Tailscale also use it for device addresses.

What does a 169.254 IP address mean?

A 169.254.x.x address is a link-local (APIPA) address that a device gives itself when it cannot get an address from DHCP. It can talk to other devices on the same segment but has no gateway or internet access. Check the DHCP server, cable, switch port, VLAN and Wi-Fi connection, then renew the lease.

How many usable hosts are in a /24?

A /24 (subnet mask 255.255.255.0) has 256 addresses, of which 254 are usable for hosts, because the first is the network address and the last is the broadcast address. In general a subnet has 2 to the power of (32 minus the prefix) addresses, minus 2 for hosts. Azure reserves five addresses per subnet, leaving 251 in a /24.

What is CIDR notation?

CIDR (Classless Inter-Domain Routing) notation writes a network as an address followed by a slash and a prefix length, for example 192.168.1.0/24. The prefix is the number of bits that identify the network, so /24 equals the subnet mask 255.255.255.0 and leaves 8 bits for hosts. CIDR replaced the old Class A, B and C system in 1993.