NAT and address scope utility
Compare a local or interface IP with the public address seen by websites. The tool classifies IPv4 and IPv6 ranges, explains NAT and carrier-grade NAT clues, shows whether an address is internet-routable, and builds a practical note for port forwarding, firewall allowlists and support tickets.
A browser normally cannot read every private address assigned to your device. Paste the local address from your router, operating system or server panel, then compare it with the internet-facing address.
Public IP vs local IP, without the usual confusion
A local IP identifies an interface inside a network you control or participate in. A public IP identifies the address that the outside world can reach or at least see on the internet path. At home, your laptop may use 192.168.1.42 while websites see one public address owned by your router or provider. In an office, a server panel may show a private address even though a load balancer, firewall or cloud gateway exposes the service through another public address.
That difference is not a detail. It decides which value belongs in a firewall allowlist, why a port forwarding rule points to an internal host, why two unrelated homes can both use 192.168.1.42, and why a support team may ask for the IP visible from outside instead of the IP printed by your operating system.
What this comparison is useful for
- Confirm that a pasted interface IP is private, link-local, carrier-grade NAT, unique local IPv6 or globally routable.
- Compare a LAN address with the public address your current browser exposes.
- Spot a carrier-grade NAT clue before spending time on a port forwarding rule that cannot receive inbound traffic.
- Choose the right IP for VPN access, hosting allowlists, remote admin rules and troubleshooting notes.
- Explain network scope to a client or colleague with a copyable report.
NAT changes the path, not the meaning of the addresses
Network Address Translation lets many private IPv4 devices share a smaller number of public addresses. Your local address remains useful inside the LAN; the public address remains the one remote services see. NAT is common, but it is not a security plan by itself. Routers, host firewalls, cloud security groups and application authentication still decide what can be reached.
Carrier-grade NAT adds another provider layer. If your router WAN address is inside 100.64.0.0/10, the provider may be sharing public IPv4 among customers. In that case classic inbound port forwarding can fail even when the router rule looks correct. A public IPv6 deployment changes the picture again: the address can be globally routable while firewall policy still blocks unwanted inbound connections.
Practical mistakes this tool helps avoid
- Allowlisting a 192.168.x.x address on a remote SaaS firewall.
- Publishing a port forward to a local host that later receives a different DHCP address.
- Assuming every non-RFC1918 IPv4 address is safe to expose without checking special-use ranges.
- Confusing public reachability with geolocation or identity.
- Ignoring VPNs, proxies and company gateways when the visible public IP changes.
Common questions
Can a website see my local IP?
Normal web requests expose the public address used for the connection. Browsers do not provide a simple inventory of private device addresses to every website, so paste the local value when you want to compare it.
Which IP should I use for a firewall allowlist?
A remote firewall usually needs the public address seen from the remote service. A local firewall rule inside your LAN may need a private subnet or local host address instead.
Does a public IP mean the device is exposed?
No. A globally routable address describes scope. Firewalls, NAT rules, security groups, listening services and authentication decide exposure.
Which IP ranges are private?
10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 for IPv4, plus fc00::/7 for IPv6. These are not routable on the public internet and are reused on every local network.
Why do all my devices share one public IP?
Your router uses NAT to translate many private addresses to one public IP. Outbound connections are tracked so replies return to the right device.
What is CGNAT and how does it affect me?
Carrier-grade NAT means your ISP shares one public IP across many customers. You cannot host inbound services directly and may need a relay or a VPN with a public endpoint.
