What is a private IP address? Private, reserved, and bogon addresses, explained

You typed "what is a private IP address" into a search box, and there's a decent chance you did it because one turned up somewhere it had no business being — a request log, a signup record, an X-Forwarded-For header on traffic that came in off the open internet. A private IP address is one drawn from a range the internet's governing bodies set aside for use inside a network rather than across it. Your laptop has one. Your home router has one. Neither should ever be the origin of a request that reached your public API. When one is, something is broken or someone is lying — telling those apart is the point here.

The private ranges, and how they got that way#

In 1996, RFC 1918 carved three blocks out of IPv4 space and declared them off-limits for the public internet. Any organization can use them internally without asking anyone:

• 10.0.0.0/8 — one huge block, 16.7 million addresses
• 172.16.0.0/12 — the middle one everybody forgets (it's 172.16.x.x through 172.31.x.x, not all of 172.*)
• 192.168.0.0/16 — the one on the sticker under your router

Two more ranges behave privately without being RFC 1918. 127.0.0.0/8 is loopback — 127.0.0.1 is your own machine talking to itself. 169.254.0.0/16 is link-local: the range a device assigns itself when it asks for a DHCP lease and nobody answers. If you've seen a 169.254.* address, a network handshake failed somewhere.

The common thread is that routers on the public internet are expected to drop these. They are addresses for a private conversation, and they don't survive the trip across a public network.

Reserved and bogon addresses#

Private is one flavor of "not a normal public address." There are others. IANA marks whole ranges as reserved for specific jobs — 192.0.2.0/24 and its siblings are documentation ranges (the IPs you put in a blog post so you don't accidentally name a real host), 255.255.255.255 is broadcast, 0.0.0.0 is "this network."

A bogon is the umbrella term: any address that should never appear as the source of traffic on the public internet — private ranges, reserved ranges, and blocks not yet allocated to anyone. The name is short for "bogus." A packet claiming to come from a bogon reached you carrying a return address that cannot be real.

Why a private or bogon source IP is a red flag#

Here is the part that matters if you run anything public-facing. When a request arrives at your API and the source IP — or the client IP your proxy hands you in a header — falls in a private or bogon range, there are only two explanations, and neither is good:

1. Misconfiguration. A load balancer or reverse proxy is forwarding its own internal address instead of the real client's, or an X-Forwarded-For header is being read without being set. Your geo rules, rate limits, and audit logs are now keyed on garbage.
2. Spoofing. Someone is setting a client-IP header by hand to 127.0.0.1 or 10.0.0.1, betting that a downstream service treats "internal-looking" addresses as trusted. This is a standard trick for slipping past IP allowlists.

Either way, a private or bogon address in a field that is supposed to hold a public client IP is a signal to distrust that record — not to geolocate it, because there is nothing real to locate.

Classify them yourself first#

You do not need a service to answer "is this address private." The standard library does it. In Python, ipaddress has shipped since 3.3:

import ipaddress

ip = ipaddress.ip_address("192.168.1.10")
print(ip.is_private)     # True
print(ip.is_loopback)    # False
print(ip.is_link_local)  # False
print(ip.is_global)      # False  <- the one to check for public traffic

For a lot of cases that is the whole job — is_global is False and you are done. Node's net module is thinner: it validates the address and tells you the version, but it will not classify the range for you.

const net = require("node:net");

net.isIP("192.168.1.10"); // 4  (valid IPv4)
net.isIP("::1");          // 6  (valid IPv6)
net.isIP("not-an-ip");    // 0  (invalid)

That gap — valid IP versus what kind of IP — is where you either write the range checks by hand or reach for something that already has them. There is a longer walk-through for Node.js and the Python version.

Where Boundstone fits#

If you are checking IPs in one script, use the stdlib. If you are checking them across a fleet of services in three languages and you would rather have one answer that every service agrees on, that is the API layer:

curl -s https://api.boundstone.io/v1/verify/ip \
  -H "Authorization: Bearer bs_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ip":"192.168.1.10"}'

{
  "valid": true,
  "version": 4,
  "normalized": "192.168.1.10",
  "classification": "private",
  "is_public": false,
  "is_bogon": true,
  "checks": {
    "performed": ["format", "version", "range_classification"],
    "not_performed": ["geolocation", "asn", "hosting_datacenter", "proxy_vpn_tor", "reputation"]
  }
}

Read the not_performed array, because it is the honest part. Boundstone classifies the range — that is arithmetic on the address, it costs nothing, and it is in the free tier. It does not geolocate the address, look up the ASN, tell you whether it is a datacenter, or flag it as a proxy, VPN, or Tor exit. That is IP intelligence, it needs licensed data, and it is not shipped. We would rather hand you an honest answer with an empty middle than a confident guess. When Boundstone says an address is public and valid, you can trust it because you can see exactly what "valid" did and did not cover.

You can run the classifier with no key and no signup at the free IP validator.

The short version#

• A private address (10/8, 172.16/12, 192.168/16), a loopback (127/8), or a link-local (169.254/16) address belongs inside a network. A bogon is any address that cannot legitimately be a public source.
• A private or bogon address arriving as a public client IP means misconfiguration or spoofing. Distrust the record; do not try to locate it.
• Classify with the stdlib first — Python's ipaddress.is_global is often all you need.
• Reach for the API's /v1/verify/ip when you want one classification contract across every service — try it keyless first — and read checks.not_performed so you know precisely what the "valid" is worth.