Public vs Private IP Addresses: Ranges, NAT and Why the Difference Is a Security Boundary

IP addresses split into two worlds:

• Private (RFC 1918): 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 — usable freely inside local networks, but never routed on the public internet. Add 127.0.0.0/8 (loopback) and 169.254.0.0/16 (link-local) to the list of “internal” space.
• Public: everything else — globally unique, routable, and mappable to a location/ASN via GeoIP databases.

A machine with a private address reaches the internet through NAT: a router translates private-source connections to its own public IP. This is why the address ipconfig shows on your laptop (often 192.168.x.x) differs from the address websites see — that one belongs to the router or the ISP.

Why the split is a security boundary

Any tool that “takes an address and connects to it” — header checkers, redirect testers, URL previews — becomes a network pivot if it accepts private destinations: an attacker submits http://192.168.1.1/admin and the tool fetches the owner’s internal network from the inside. This is SSRF (Server-Side Request Forgery), consistently on the OWASP list. Every fetching tool on WhoDNS rejects private, loopback and link-local targets for exactly this reason; if you build anything that fetches URLs, keep the same rule and validate after DNS resolution, because a public-looking hostname can resolve to a private IP.

GeoIP and its limits

Country-level GeoIP accuracy is high — especially with local database coverage — while city-level varies widely; datacenter IPs are sometimes mapped to the wrong country entirely. Treat GeoIP as one signal among several in fraud or access decisions, never as the verdict. The WhoDNS IP tool combines the lookup with ASN and GeoIP data from an internal offline database, so you get the answer without your query being logged by a third-party API.

🔗 Related tool: Look up any IP address with GeoIP details