A public IP address is reachable on the internet and is assigned by your carrier. A private IP address, such as one starting with 192.168 or 10, is used only inside your own network and cannot be reached directly from outside. Your firewall or router sits between the two and uses network address translation, or NAT, so dozens or hundreds of private devices can share one public address. That works well for browsing and cloud apps. It gets in the way when something outside needs to reach something inside, which is when businesses need static public IPs, port forwarding or a different design.
This sounds like an IT topic, and it is, but it shows up in business decisions: whether a quote includes enough static IPs, why a camera system cannot be reached remotely, why a VPN keeps dropping, or why a vendor asks for "your public IP" to allow your office into their system.
Public addresses
Public IPv4 addresses are globally unique. They are allocated to carriers and large organizations by regional internet registries, and your carrier assigns some of its addresses to your circuit. The supply is limited: IPv4 has about 4.3 billion addresses in total, and the registries have largely run out of new ones to hand out, which is why carriers charge for larger blocks and why IPv6 exists.
A business circuit usually comes with either a dynamic public address, which can change, or one or more static addresses, which do not. Our guide to static IPs and BGP covers block sizes and when you need them.
Private addresses
Three ranges are reserved for private use and never routed on the public internet:
| Range | Written as | Typical use |
|---|---|---|
| 10.0.0.0 to 10.255.255.255 | 10.0.0.0/8 | Larger and multi-site networks, with room to divide by site and department |
| 172.16.0.0 to 172.31.255.255 | 172.16.0.0/12 | Medium networks, some VPNs and cloud setups |
| 192.168.0.0 to 192.168.255.255 | 192.168.0.0/16 | Home and small office routers, often 192.168.0.x or 192.168.1.x by default |
Anyone can use these ranges, so millions of networks use the same addresses at once. That is fine until two of them need to connect, for example over a VPN between your office and a partner, or between two offices that both kept the router's default 192.168.1.x. Then the overlap has to be fixed or translated. If you have more than one site, give each a different range from the start.
One other range is worth recognizing: an address starting with 169.254 means a device asked for an address and got no answer, which usually points to a DHCP or cabling problem rather than an internet outage.
How NAT works
When a laptop at 192.168.1.25 opens a website, the firewall replaces the private source address with your public address, notes which internal device made the request, and sends it on. When the reply comes back, the firewall looks up its notes and forwards the reply to the laptop. With many devices sharing one public address, the firewall also tracks port numbers to tell the conversations apart. This is often called port address translation, or NAT overload, and it is what nearly every office router does by default.
The important consequence is that NAT lets traffic out easily and lets nothing in unless it is a reply to something that went out. That is a useful side effect for security, but it is not a firewall policy, and it is no substitute for one. Our small business firewall guide covers what a firewall should actually be doing.
When something outside needs to reach in
Port forwarding
Port forwarding tells the firewall to send traffic arriving on a specific port of your public address to a specific internal device. It is how businesses have traditionally exposed a camera recorder, a phone system, a server or a remote desktop. It works, and it is also one of the most common ways attackers get in, because every forwarded port is an open door that anyone on the internet can try. Forward only what you must, restrict it to known source addresses where you can, and keep the device behind it patched.
1:1 NAT
If you have a block of static public IPs, you can map one public address entirely to one internal server. This keeps services separate and makes firewall rules clearer, and it is common for mail servers, VPN gateways and hosted applications.
Better options for remote access
For staff reaching office systems, a VPN or a zero-trust access service is usually safer than forwarding ports to individual devices. Many camera and building systems now connect out to a cloud service instead, which avoids inbound connections altogether. Our guide to business VPN options compares the approaches.
Carrier-grade NAT: when your public address is not yours
Some services, especially mobile and fixed wireless, and some low-cost broadband, put customers behind carrier-grade NAT. Your router receives an address from a shared range, often in 100.64.0.0/10, and the carrier translates many customers onto its own public addresses. Outbound traffic works normally. Inbound connections do not, and port forwarding on your router does nothing, because the carrier's NAT sits in front of it.
Signs you are behind carrier-grade NAT include a WAN address on your router starting with 100.64 to 100.127, or a WAN address that does not match what a "what is my IP" website reports. If you need inbound access on such a service, ask the carrier about a static or public IP option, or use a cloud-based remote access service.
Double NAT
Double NAT happens when two devices in a row both translate addresses, usually a carrier gateway and your own firewall. It commonly causes dropped VPNs, one-way audio on calls and failed remote access. The usual fix is bridge mode or a static IP configuration on the carrier's device. We cover it in carrier equipment vs your own router.
What about IPv6?
IPv6 has so many addresses that every device can have a globally unique one, and NAT is generally not needed. That does not mean every device is exposed: the firewall still decides what may come in, and by default most allow only replies to outbound traffic. Many carriers include IPv6 at no extra cost. Our IPv6 guide covers whether to turn it on and what to check first.
Planning private addresses inside the office
Private addressing is free and entirely in your control, which is exactly why it is worth a little planning. A few habits save trouble later:
- Separate networks by purpose. Staff computers, phones, cameras, guest Wi-Fi and payment devices on their own VLANs and address ranges make firewall rules simpler and limit how far a problem can spread.
- Leave room to grow. A range sized for exactly today's devices runs out the day you add a dozen cameras.
- Reserve addresses for fixed devices. Printers, servers and access points work better with addresses that do not change, set either on the device or as reservations in DHCP.
- Avoid the defaults if you will ever connect to another site or run a VPN. Remote staff on home routers using 192.168.1.x will clash with an office on the same range.
- Write it down. A one-page table of ranges, VLANs and what lives on each is enough for most offices, and it saves hours when a contractor arrives.
When a business needs public IPs
| Situation | What you need |
|---|---|
| Browsing, email, cloud apps only | One dynamic address is usually fine |
| Vendors whitelist your office address | At least one static IP |
| Site-to-site VPN or a VPN for remote staff | A static IP is strongly preferred |
| Hosting a server, mail gateway or several services | A block of static IPs, often with 1:1 NAT |
| Your own address space and multiple carriers | BGP on a dedicated circuit |
A worked example
Hypothetical: the business and its setup are invented to show how the pieces fit.
A property management company has 20 staff, a camera recorder at each of three buildings and a file server at head office. Today it has one dynamic address at head office, ports forwarded to the camera recorder and to a remote desktop on the server, and default 192.168.1.x networks at all three buildings.
The plan: order a static IP block at head office, run the remote desktop through a VPN instead of a forwarded port, move the camera recorders to the manufacturer's cloud connection so no ports need to be open, and renumber the three buildings to 10.1.x, 10.2.x and 10.3.x so they can be joined by site-to-site VPN without overlaps. The forwarded ports close, staff reach the server through the VPN, and a vendor that needs to whitelist head office has a stable address to use.
Getting the addressing on the quote
When we price circuits from several Tier 1 carriers for your address, we list how many static IPs each quote includes, what a larger block costs and whether IPv6 is available, so you compare like with like. The carrier pays FiberX, so nothing is marked up, and our lowest-price promise applies. Quotes are free, you usually hear back the same day, and Phil Morales is your one point of contact. See our dedicated internet access options or send us your address, call 478-758-8091 or text (347) 870-0965.
