system-design · beginner

IP Addresses — How Machines Find Each Other

Start here

An IP address is a number that helps the network deliver data to the right machine (more precisely, to a network interface on a machine).

When you visit a website:

1. DNS turns a name into an IP address.
2. Your computer sends packets toward that address.
3. Routers forward those packets hop by hop until they arrive.

What you will learn

1. Define IP address in plain English.
2. Contrast IPv4 and IPv6.
3. Explain public vs private addresses.
4. Introduce NAT (Network Address Translation) gently.
5. Read a simple CIDR block (/24) without fear.
6. Connect IP to ports, DNS, and load balancers.
7. Work a home Wi-Fi + cloud VPC example.
8. Avoid confusing IP identity with user identity.

What you should know first

Words you need before we begin

Simple story: street addresses for packages

A package needs a street address to arrive. IP is like that address system for digital packages (packets).

• Public IP ≈ a unique street address the postal service understands worldwide.
• Private IP ≈ apartment numbers inside a building; the outside world may only know the building address.
• NAT ≈ the building receptionist who rewrites apartment mail to use the building’s public entrance.
• DNS ≈ the phone book from “café name” to street address.

The problem IP solves

Without shared addressing:

• Each network would invent private schemes that cannot interconnect.
• The internet could not be a network of networks.

Step-by-step explanation

Step 1 — Addresses identify interfaces, not “souls”

A laptop can have:

• Wi-Fi IP
• Ethernet IP
• VPN IP

Step 2 — IPv4 shape

IPv4 uses 32 bits, usually written as four decimals:

203.0.113.10

There are about 4.3 billion possible values — not enough for every device on Earth to have a unique public IPv4 forever. That scarcity drove private ranges + NAT and the push to IPv6.

Step 3 — Private IPv4 ranges (memorize the idea)

Common private ranges (RFC 1918):

These are not meant to be unique on the global internet. Two companies can both use 10.0.0.5 internally.

Step 4 — Public IPs

Public addresses are assigned through internet registries and cloud providers. Your home router usually has one public IPv4 (or a carrier-grade NAT share). Cloud VMs and load balancers get public IPs when you attach them.

Exposing a database on a public IP without a firewall is a classic incident seed.

Step 5 — NAT in everyday life

Network Address Translation (NAT) lets many devices with private IPs share outbound connectivity via fewer public IPs.

Home example:

1. Phone 192.168.1.20 opens a connection to a server.
2. Router rewrites the source to the household public IP + a chosen port.
3. Replies come back to the router, which maps them to the phone.

• Many users may appear as one IP (rate limits, abuse bans must be careful).
• Inbound connections to a private device need port forwarding, tunnels, or reverse connections.
• Logs that only store client IP can be coarse behind corporate NAT.

Step 6 — CIDR without tears

CIDR writes a prefix length after /:

• 10.0.0.0/24 ≈ 256 addresses (10.0.0.0–10.0.0.255), often ~254 usable hosts.
• /32 = single IPv4 address.
• /16 = much larger block.

Allow tcp/443 from 10.0.1.0/24

meaning “HTTPS from that private subnet.”

Step 7 — IPv6 (lightweight)

IPv6 uses 128-bit addresses, written in hex groups:

2001:db8::1 (documentation example style)

Goals include a vastly larger space and simpler end-to-end addressing. Dual-stack systems support both v4 and v6. As a beginner, know:

• AAAA DNS records return IPv6.
• Some networks are IPv6-first.
• Firewalls must cover both families.

Step 8 — IP is not authentication

Anyone can spoof claims in some contexts; production auth uses cryptographic identity (TLS certs, tokens), not “the IP looked friendly.” IP allowlists are a network control, not a full user login system.

Visual mental model

Name to packet delivery

flowchart LR
  N[Name example.com] --> D[DNS]
  D --> IP[IP address]
  IP --> R[Routers]
  R --> H[Host interface]

Learning question: Which step fails if DNS is wrong but the server is healthy?

Caption: DNS and IP are different failure domains.

Private network + NAT

flowchart LR
  P1[Phone private IP] --> NAT[Home NAT router]
  P2[Laptop private IP] --> NAT
  NAT --> Pub[Public IP]
  Pub --> Net[Internet]

Learning question: What address does the website usually see?

Caption: Often the router’s public IP for many devices.

Complete worked example: cloud web app

Setup

• VPC CIDR 10.0.0.0/16
• Public subnet with load balancer public IP
• Private subnet 10.0.2.0/24 with app tasks at 10.0.2.10–20
• Database only private 10.0.3.10

Rules of the road

1. Users hit public LB IP (from DNS name).
2. LB forwards to private app IPs.
3. Apps talk to DB over private IP — never need public DB exposure.
4. Outbound package installs may use NAT gateway so private tasks reach the internet without inbound exposure.

Failure

A firewall allows 0.0.0.0/0 to DB port “temporarily.” The private IP was not enough protection once a route/public path existed. Network identity needs policy, not hope.

How it works in production

What you configure daily

• Security groups / NACLs / firewall rules by CIDR
• Load balancer target IPs or attachments
• Kubernetes pod IPs (ephemeral) vs Service IPs
• Allowlists for admin access (VPN exit IPs)

Observability

• Flow logs showing source/dest IP and ports
• Deny counts on firewalls
• Client IP headers (X-Forwarded-For) carefully trusted only from your LB

Ephemeral addresses

In modern clouds, instance IPs come and go. Prefer DNS names, target groups, and service discovery over hard-coded IPs in app config.

Failure modes

Trade-offs

Compare with related concepts

Common misunderstandings

1. “Private IP means secure.”

1. “IP never changes.”

1. “localhost is my public identity.”

1. “Blocking an IP blocks one human.”

1. “IPv6 is optional forever.”

Check your understanding

A private IPv4 address

A guaranteed unique public internet address for one person forever

A DNS domain name

A TLS certificate fingerprint

Sharing public connectivity across many private devices

Encrypting HTTP into HTTPS by itself

Indexing SQL tables

Compressing images

Practice

1. Label each as public/private/special: 10.0.2.15, 8.8.8.8, 127.0.0.1, 192.168.0.1.
2. Write a minimal firewall rule set for app subnet → DB subnet on port 5432.
3. Explain why logging only client IP may mis-count users behind CGNAT.
4. Describe what breaks if you bake a spot VM’s public IP into a mobile app.
5. Sketch DNS + LB + private apps using IPs only as implementation detail.

Revision summary

1. IP addresses locate network interfaces for routing.
2. IPv4 scarcity led to private ranges and NAT; IPv6 expands space.
3. Public vs private is about routability, not automatic security.
4. CIDR expresses ranges for policy.
5. Prefer names and dynamic registration over hard-coded IPs.
6. Do not confuse network allowlists with user authentication.

Glossary

Abbreviations and terminology

What to learn next

Primary next lesson: OSI Model — Seven Layers as a Debugging Map

Then revisit load balancing with IP targets and health checks in mind.

Track: Engineering Foundations

Previous: HTTP and HTTPS — How the Web Speaks

Next: Leader Election — Picking One Coordinator

By Shubham Jain

All articles · Study paths

Shubham Jain · Learning Lab