Kernaali ToolsCommon IPv4 ranges
| Range | Purpose | Operational note |
|---|---|---|
| 10.0.0.0/8 | Private use | Coordinate internally to avoid VPN overlap |
| 172.16.0.0/12 | Private use | 172.16 through 172.31; not all 172/8 |
| 192.168.0.0/16 | Private use | Often overlaps between sites |
| 100.64.0.0/10 | Shared address space | Carrier-grade NAT; not RFC 1918 |
| 127.0.0.0/8 | Loopback | Refers to the local host |
| 169.254.0.0/16 | Link-local | Not a substitute for routed addressing |
| 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 | Documentation | Use in published examples |
| 198.18.0.0/15 | Benchmarking | Isolated testing |
| 224.0.0.0/4 | Multicast | Group addressing, not ordinary unicast |
| 0.0.0.0 | Unspecified / this host | Context matters |
| 255.255.255.255 | Limited broadcast | Not forwarded as ordinary unicast |
Common IPv6 ranges
| Range | Purpose | Operational note |
|---|---|---|
| ::/128 | Unspecified | Not an interface destination |
| ::1/128 | Loopback | Local host |
| fc00::/7 | Unique local | Locally assigned ULAs normally use fd00::/8 |
| fe80::/10 | Link-local | Interface scope matters |
| ff00::/8 | Multicast | IPv6 has no broadcast |
| 2001:db8::/32 | Documentation | Published examples |
| ::ffff:0:0/96 | IPv4-mapped | An API representation; not native IPv6 routing |
Private does not mean trusted
Private addresses still need firewall policy and access control. Conversely, an address outside these selected ranges is not automatically reachable on the public Internet. IANA maintains more entries and exceptions than this short operational reference.
Before allocating
Check all site, VPN, cloud and partner routes for overlap. For example, 172.20.4.0/24 is private, while 172.40.4.0/24 is outside RFC 1918. A public address still requires a legitimate allocation and a working route.
Technical references
Reviewed 9 September 2026. Found an issue? Send a correction with a reproducible example.