I know that the IP addresses in range - are reserved and to be used for private network.

My system IP is in 10...* range (private). It is connected to our corporate Intranet and it further connects to the Internet through a proxy. When I try to check my IP (by accessing http://whatismyip.org/ for example), it shows the IP as 192.168.x.x (i.e. in private range). How can this be possible?

Is it acceptable to use the IPs in the private range as a public IP? Does it mean that there is no NAT happening before the requests leave our internal network?

  • 3
    It looks like whatismyip may be messing up your public ip address. The private ip addresses are not routeable on the public internet.
    – Milhous
    Aug 21 '09 at 13:56
  • I checked with some other sites as well (dynamic.zoneedit.com/checkip.html), and the result it same! :-/
    – Mani
    Aug 21 '09 at 14:10
  • Correct me if I'm wrong, but the wording of this question makes it sound like another homework one... Aug 22 '09 at 22:24

Any IP can be routed. But a network admin or an ISP that's worth their salt will block the egress/ingress of packets sourced from or destined for those addresses at the edge of their network.

There is no good that can come of allowing that traffic in or out of your network. Apply:

Extended IP access list 111
    10 deny ip any
    20 deny ip any
    30 deny ip any
    40 deny ip any
    50 deny ip any

to the outbound interface of your edge router. Reverse for the inbound.

  • 3
    There are some global resources available on multicast, so you may want to adjust the 224 range to allow for those services.
    – chris
    Aug 21 '09 at 15:00
  • Oh, and you probably would want to add the zero config / local-link addresses of to the list of addresses that shouldn't be seen on your wan port...
    – chris
    Aug 21 '09 at 18:40
  • heh, I'd hate to see the network configuration that would allow the 169.254/16 addresses into the network =) Aug 23 '09 at 1:41

You probably don't connect directly to whatismyip.com but via a firewall or proxy. In that case, whatismyip should display the IP of said proxy. Maybe they are smart and examine the HTTP header which might still contain your private IP.

Or whatismyip.com is so close (from your ISPs point if view) that the private address range does in fact resolve. ISP usually don't filter private address ranges; they rely on the fact that replies won't make it back home (since the routers on the way have no idea to know where to send the package). But some network components are "smart" and remember "hey, that address range always comes from there" and try to send packets back.

Also, someone within the company could have created a local copy for http://whatismyip.org/ which resolved addresses internally.

  • I just tested it and the IP address on Whatismyip.org is not your X-Forwarded-For, it is indeed your public IP address. If I go to Whatismyip.COM it shows my Public IP address and below it mentions a possible proxy, which is actually my X-Forwarded-For address.
    – Brett G
    Aug 21 '09 at 15:06

Private IPs cannot be routed on the Internet. Some proxies though will include your private IP as an HTTP header when connecting to public sites. It's then possible for those public sites to display your private IP address. Whether whatismyip.com is doing this, I do not know.

If a gateway router receives a packet destined for a private IP address it will just drop the packet, because there's nothing it can do.

  • Usually the header is X-Forwarded-For. en.wikipedia.org/wiki/X-Forwarded-For
    – CalebD
    Aug 21 '09 at 14:06
  • FWIW, serverfault does this too, if you check your user page you can see an internal IP, assuming you are behind an HTTP proxy. Aug 21 '09 at 14:43
  • 1
    "Public IPs cannot be routed on the Internet", don't you mean "Private"? Besides, they can be routed and are routed by some ISPs. But a best practice is to drop any private addressed packages in Internet routing, and most do.
    – Andrioid
    Aug 21 '09 at 14:46
  • This is really not true -- there is no difference between and as far as the internet is concerned. The RFC1918 space is simply a convention that everyone agrees to, so we drop traffic from the "public" interfaces of our routers that has a destination of or or Instead of "can't" it is "don't"
    – chris
    Aug 21 '09 at 14:56

Martian Packets

What you see are probably martian packets which might arise from network equipment malfunction or misconfiguration. If you listen on the WAN interface of your border router with a packet sniffer like tcpdump you might watch those packets directly.


I haven't heard about whatismyip.org, i've always used whatismyip.com (note the TLD). curiously, the '.org' one gives my local number, while the '.com' one gives the external IP.

  • For me, both of those sites gave my public address.
    – user640
    Aug 21 '09 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.