15

I have a common home network consisting of a wireless router with many devices connected to it. I understand that because of NAT, all devices attached to the router connect to the outside of it via its IP address, with varying NAT ports.

Is the router's IP address really public? Or is there another level of NAT in my ISP's network? Is there a way to determine this?

migrated from security.stackexchange.com May 28 at 8:05

This question came from our site for information security professionals.

  • 4
    Not a security question, depends on ISP. Most have another level of NAT and charge extra for public IP where I live, but that may vary. You can check by comparing your router IP it thinks it has with your actuall IP. If there is another level of nat, the router will have a local IP. – Peter Harmann May 27 at 3:13
  • @PeterHarmann If the question is about internet privacy, then it's on-topic, but I agree this one is iffy. – forest May 27 at 3:20
  • if you want to reduce your visibility you could use a vpn – Viktor Mellgren May 27 at 14:09
  • 1
    @PeterHarmann it really depends on location and infrastructure. Here in France you almost always have a public IP directly on the router (wether it is xDSL, cable or FTTH) but it's usually dynamic (changes at each session) and you may have to pay for a static one. – zakinster May 27 at 14:12
  • Even if you do have another NAT layer (such as with IPv4 over native IPv6 on fiber in large parts of Europe), or IP-per-reconnect dynamic IPv4 address, the address still obviously is public in general, and public pointing at your router the moment you connect to a server (or do a DNS lookup for that matter). It cannot be any different, or traffic couldn't find its way towards you. Also, even if your address changes, it is usually logged very pedantically who had which IP address assigned at which point in time. Law enforcement (and, terror laws) usually requires that to be the case. – Damon May 27 at 18:56
26

A router has multiple IPs. Its public IP is, of course, public. That is the address that you give to any website you connect to so the server knows where to send a reply. A router also has a gateway IP, which is typically the address on your LAN which other devices behind the router see. This IP is private in that it does not exist on the public internet, but it is not secret (most people use the same range).

My question is, is the router's IP really public?

It is public, but you don't have to worry about it. Knowledge of an IP address is typically not a problem unless you need anonymity. You don't have to worry about being hacked or tracked down based on IP. I explained in another answer why there's no need to worry about having a public IP address. If the address wasn't public, then you wouldn't be able to hear a response from any site you connect to!

Or is there another level of NAT in my ISP's network?

Some ISPs have another level of NAT called Carrier-Grade NAT, or CGN. If your public address as seen by the router (not by websites that check your IP) is in the range of 100.64.0.0/10 (see RFC 6598), then you are most definitely using CGN. If you have any doubts, call your ISP and ask them.

  • 11
    -1 for "You don't have to worry about being hacked or tracked down based on IP." – Pedro Lobito May 27 at 12:57
  • 9
    You can't be tracked personally with just a public IP. It will point to your city/town but an attacker can never get your exact location without the help of the ISP. Also, assuming no port forwarding is enabled, there is no way to "hack" someone with just their public IP as only the router can be reached, not the machine of the user itself. – Echo May 27 at 14:15
  • 10
    "Its public IP is, of course, public." it usually is but not always as demonstrated in your last paragraph. – zakinster May 27 at 14:24
  • 13
    "Some routers have another level of NAT" - that's not really a property of the router? It would be more accurate to say, "Some ISPs have another layer of NAT", right? – Blorgbeard May 27 at 15:21
  • @Blorgbeard Good point. I'm not sure how that got in there. I've fixed that. – forest May 28 at 1:02
30
  1. Connect to your router's admin interface, and check the "public" or "WAN" IP address.
  2. Then connect to a site like https://whatismyipaddress.com/ to check what IP address is visible from the Internet.

If both match, your router's IP is indeed public, and there is no other level of NAT.

If the two addresses don't match, then there is another level of NAT done by your ISP, something called "Carrier-Grade NAT" (CGNAT).

Whether CGNAT is used depends a lot on ISPs. Mobile/wireless ISPs use it a lot. Fixed-line (DSL, Cable, etc.) ISPs use it less, but this can vary a lot from country to country and ISP to ISP.

  • There is also the option that you are connected via IPv6 and the provider NATs to a limited IPv4 pool. (DSlite) the described procedure will detect this, too. – eckes May 28 at 10:51
3

Yes, your IP is public. Most ISPs that I've seen, the IP address rotates rarely. In other words, your IP is public, every website you visit can see it, and it almost never changes.

You can check your IP address by googling "What is my IP" or https://whatismyipaddress.com/. You can see, there, what every other website sees.

Your phone number is also public. Most people you call can see your number. Anyone can call your number.

  • 1
    A difference between phone numbers and IP addresses is that you can have a whole phone conversation where one side (the callee) doesn't know the other side (the caller)'s phone number. This isn't possible for IP-based communication. – Gilles May 27 at 5:39
  • 2
    The phone number is a bad analogy here. – schroeder May 27 at 12:10
1

Command traceroute (tracert on Windows) may help.

Run traceroute www.google.com, if you get

1 192.168.x.1 (your router's LAN IP)
2 100.x.x.x (ISP's NAT)
3 x.x.x.x (some public IP)
4 x.x.x.x (some public IP)
......

If ISP has another level of NAT, it ususally gives you an IP 100.x.x.x (100.64.0.0/10)

  • I like this approach, but exactly in what range should the second's hop IP be? Should it be in a CIDR block or could it be another? – MPA95 May 27 at 15:21
  • 2
    The second hop when using CGN is, as this answer mentions, in 100.64.0.0/10. – forest May 28 at 1:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.