Reserved IP addresses are ranges set aside for documentation, examples, or future use. The famous ones: 192.0.2.0/24 (TEST-NET-1), 198.51.100.0/24 (TEST-NET-2), 203.0.113.0/24 (TEST-NET-3), and the loopback 127.0.0.0/8.
Table of contents
- The TEST-NET ranges
- The loopback range
- The private ranges (RFC 1918)
- The other reserved ranges
- When reserved addresses leak
- The IPv6 reserved ranges
- The carrier-grade NAT angle
- FAQ
The TEST-NET ranges
RFC 5737 defines three ranges for documentation:
- 192.0.2.0/24 (TEST-NET-1)
- 198.51.100.0/24 (TEST-NET-2)
- 203.0.113.0/24 (TEST-NET-3)
These addresses will never be assigned to any real host on the public internet. The team that uses them in documentation, examples, or test configurations is using them exactly as intended.
The loopback range
127.0.0.0/8 is reserved for loopback. The familiar 127.0.0.1 is localhost; the rest of the range (127.0.0.2 through 127.255.255.254) also points back at the host. The team that wants multiple localhost addresses uses 127.0.0.2, 127.0.0.3, etc.
The private ranges (RFC 1918)
RFC 1918 reserves three ranges for private networks:
- 10.0.0.0/8 (16 million addresses)
- 172.16.0.0/12 (1 million addresses)
- 192.168.0.0/16 (65,000 addresses)
These addresses are not routable on the public internet. The team that uses them on a private network (a corporate LAN, a VPC, a Docker bridge) is using them as intended. The team that tries to route them on the public internet has a misconfiguration.
The other reserved ranges
Other ranges to know:
- 169.254.0.0/16 (link-local). The address that the host assigns itself when DHCP fails. The team that sees a host with 169.254.x.x has a DHCP problem.
- 224.0.0.0/4 (multicast). Used for one-to-many communication. Most home networks never use this.
- 240.0.0.0/4 (reserved for future use). The team that sees traffic to these addresses has a misconfiguration.
- 0.0.0.0/8 (this network). Used by the kernel for “any address”.
When reserved addresses leak
The five scenarios where reserved addresses cause issues:
- A vendor ships a device with a hard-coded 192.168.1.1. The team’s network uses the same range; conflict.
- A test config uses TEST-NET-1. The team’s staging environment uses the same range; tests fail in unexpected ways.
- A log entry references a private IP. The team that shares logs publicly leaks internal network topology.
- DNS returns a private IP. The team that resolves a public hostname to a private IP (via /etc/hosts or a split-horizon DNS) breaks for external users.
- A firewall rule is too permissive. The team that allows 10.0.0.0/8 from the public internet is asking for trouble.
The IPv6 reserved ranges
The IPv6 equivalents:
::/128. Unspecified address (IPv4’s 0.0.0.0).::1/128. Loopback (IPv4’s 127.0.0.1).fe80::/10. Link-local (IPv4’s 169.254.0.0/16).fc00::/7. Unique Local Addresses (IPv4’s 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).2001:db8::/32. Documentation prefix (IPv4’s 192.0.2.0/24, etc.).ff00::/8. Multicast (IPv4’s 224.0.0.0/4).
The team that uses 2001:db8::/32 in documentation is using the IPv6 equivalent of TEST-NET-1.
The carrier-grade NAT angle
The team that runs an ISP or mobile carrier has additional reserved ranges to know:
- Carrier-grade NAT (CGN) addresses.
100.64.0.0/10is reserved for CGN. Used by ISPs that share a single public IPv4 address among many customers. - Private use behind CGN. The team that has a customer behind CGN sees a 10.x.x.x or 100.64.x.x address; the team that logs the source IP needs to know which range.
- Documentation addresses for IPv6.
2001:db8::/32and the longer3fff::/20are documentation-only.
The team that runs an application behind CGN has to handle the CGN source IP differently from a directly-connected client (no reverse DNS, no geolocation, shared with many other customers).
FAQ
Can I use 192.0.2.0/24 in production?
Technically yes; nothing on the public internet routes to it. Practically no; it’s reserved for documentation. The team that uses it in production has documentation that doesn’t match reality.
What’s the difference between RFC 1918 private and RFC 5737 reserved?
RFC 1918 private addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are for private networks. RFC 5737 reserved (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24) are for documentation. The team that confuses the two uses the wrong range for the wrong purpose.
What’s 169.254.169.254?
The AWS metadata service. The team that runs on EC2 and queries 169.254.169.254 gets the instance metadata (IAM role, region, etc.). The team that hard-codes this address outside of EC2 gets nothing.
Can I use 127.0.0.1 in production?
Yes, for localhost-only services (a local cache, a local database). No, for services that need to be reachable from other hosts. The team that binds a service to 127.0.0.1 has a service that only the host can reach.
Can I use 10.0.0.0/8 on the public internet?
No. It’s a private range; routers on the public internet will not route packets to or from these addresses. The team that has services on 10.x.x.x needs NAT or a VPN to expose them to the public internet.
What’s 169.254.169.254 used for?
The AWS instance metadata service. The team that runs on EC2 and queries 169.254.169.254 gets the instance metadata (IAM role, region, user-data). The team that uses this from outside EC2 gets nothing; the address is reserved for link-local use.
Can two private networks use the same 10.x.x.x addresses?
Yes, as long as they’re not connected. The team that has two VPCs in the same AWS account uses different CIDR blocks to avoid conflicts. The team that has two separate corporate offices can both use 10.0.0.0/8; they can’t be connected without address translation.
If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.
Useful related references: