Picture a huge city where every house needs a unique address so the post can deliver letters. The internet works the same way: every computer, every smartphone or every server needs an address to send and receive packets. Those addresses are IP addresses — IP stands for Internet Protocol. Without them the internet would be chaos: nobody would know where information should go.
As a Linux beginner or an aspiring sysadmin you will hit the difference between public and private IP addresses sooner or later. You may already have looked at your home network and wondered why your router has an address like 192.168.1.1 while your internet connection from outside shows a completely different number.
That split is not an accident. It is a system for security, efficiency and coping with limited address space. The following sections unpack what sits behind it — with examples from a sysadmin’s daily work and tips you can try on your Linux system immediately.
💡 Tip for beginners: If you are new to Linux, open a terminal session, for example on Ubuntu with
Ctrl+Alt+T, and follow the examples. That helps you experience the concepts, not only read them. The commands here, such asip addr show, are available on every modern Linux system.
The starting question is: what is an IP address at all? After that comes why there are two kinds and why that matters for you as a Linux user. Analogies, diagrams and practical steps sit next to the theory — as if someone were showing you this at your desk.
What is an IP address?
An IP address is the unique identifier for every device on a network. It works like a house number combined with a postcode: it says not only where you are, but also how to reach you. In the internet protocol stack the IP address belongs to layer 3 (the network layer), which is responsible for routing packets. Every packet you send — an email, a page load or a video stream — carries the sender’s and the receiver’s IP address in the header.
There are two main versions of IP addresses: IPv4 and IPv6. The move to IPv6 has become more relevant in recent years, especially in large networks and cloud environments.
IPv4: the classic
IPv4 is the older and still most widespread version. It consists of 32 bits, split into four blocks (octets) separated by dots. Each block can take values from 0 to 255, because 8 bits (one byte) give exactly 256 possibilities (0 to 255).
A simple example of an IPv4 address: 192.168.1.100
To understand that, look at the binary layout — it helps later when you work with subnets. Each decimal number corresponds to a binary number:
192in binary:11000000168in binary:101010001in binary:00000001100in binary:01100100
Joined: 11000000.10101000.00000001.01100100 (32 bits)
⚠️ Watch out: IPv4 has only about 4.3 billion possible addresses (2^32). That sounds like a lot, but with billions of devices worldwide they have become scarce. That is why techniques such as NAT (Network Address Translation) exist, which the later sections cover.
To see your own IPv4 address on Linux, use this command:
ip addr show
The output shows all network interfaces (for example eth0 for Ethernet or wlan0 for Wi-Fi). Look for the entry under inet — that is your IPv4 address.
For example:
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 00:11:22:33:44:55 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic noprefixroute eth0
valid_lft 86000sec preferred_lft 86000sec
Here you see the address 192.168.1.100 with a subnet mask /24 (the first 24 bits define the network).
IPv6: the future
IPv6 is the newer version, built to solve IPv4 address scarcity. It uses 128 bits, which yields about 340 undecillion addresses — enough for every atom on earth and more. IPv6 addresses are written in hexadecimal (digits 0-9 and letters A-F), split into eight groups of four characters, separated by colons.
Example: 2001:0db8:85a3:0000:0000:8a2e:0370:7334
To shorten it, leading zeros can be dropped and consecutive zero groups replaced with ::: 2001:db8:85a3::8a2e:370:7334
❗ Important note: Many modern Linux distributions (such as Ubuntu 24.04 or Fedora) enable IPv6 by default. In enterprise networks or at cloud providers such as AWS, IPv6 is used more and more to keep scale.
Check your IPv6 address with:
ip addr show
Look for inet6 — for example:
inet6 2001:db8::1/64 scope global dynamic noprefixroute
valid_lft 2592000sec preferred_lft 604800sec
IPv6 brings advantages such as built-in security (IPsec is mandatory), better mobility for devices and no need for NAT in most cases. In practice many nets still run dual-stack: IPv4 and IPv6 in parallel.
🔧 Practical example: You set up a home server. With IPv4 you often have to configure port forwarding to reach it from outside. With IPv6 every device gets a global address, which makes access easier — but watch the firewalls. Use ip6tables for rules.
To visualise the layout, here is a diagram of an IP address:
+-------------------------------------------------------------+
│ Example: 192.168.1.100 │
│ │
│ +--------+--------+--------+--------+ │
│ | 192 | 168 | 1 | 100 | │
│ +--------+--------+--------+--------+ │
│ Each block: 0 to 255 (8 bits = 1 byte) │
+-------------------------------------------------------------+
IPv6 layout
+-------------------------------------------------------------+
│ Example: 2001:db8::8a2e:370:7334 │
│ │
│ +------+------+------+------+ │
│ | 2001 | 0db8 | 0000 | 0000 | │
│ +------+------+------+------+ │
│ | 0000 | 8a2e | 0370 | 7334 | │
│ +------+------+------+------+ │
│ Shortened with :: for zero groups (16 bit hex each) │
+-------------------------------------------------------------+
Why do we need two kinds of IP addresses?
This is the core:
Why do public and private IP addresses exist? The answer sits in three main reasons: address scarcity, security and efficiency.
First, scarcity:
As mentioned, 4.3 billion IPv4 addresses are not enough. If every device worldwide needed a unique address, they would have been used up long ago. Instead many devices in local nets (LANs) share private addresses, and only the router has a public one.
Second, security:
Private addresses are not reachable directly from the internet. That protects your devices from external attacks. Imagine your smartphone had a public IP — attackers could reach it directly. With private IPs the router acts as a receptionist.
Third, efficiency:
In an office or at home, hundreds of devices can use the same private addresses without colliding on the global internet. That saves resources and simplifies administration.
The apartment analogy makes it clear:
The building has a street address (public IP), each flat an internal number (private IP). The porter (router with NAT) forwards the mail.
Diagram of the idea:
+-------------------------------------------------------------+
│ Network overview |
│ │
│ Internet │
│ (the public world) │
│ ▲ │
│ │ │
│ +---------+ │
│ │ Router │ │
│ │ (NAT) │ │
│ +---------+ │
│ │ │
│ Private IP addresses │
│ +---------+ +---------+ +---------+ │
│ │ PC │ │ Tab │ │ Phone │ │
│ +---------+ +---------+ +---------+ │
+-------------------------------------------------------------+
Like an apartment building:
+-------------------------------------------------------------+
│ Apartment complex │
│ (public IP: 203.0.113.17) │
│ │
│ +---------+ │
│ │ Porter │ │
│ +---------+ │
│ │ │
│ Flats (private IPs) │
│ +---------+ +---------+ +---------+ │
│ │ 101 │ │ 102 │ │ 103 │ │
│ │ .10 │ │ .11 │ │ .12 │ │
│ +---------+ +---------+ +---------+ │
+-------------------------------------------------------------+
💡 Tip: In Linux networks you see this often: your local interface has a private IP (for example 192.168.x.x), while
curl ifconfig.meshows your public IP.
As a sysadmin this split is essential: in a company network it protects sensitive data; in the cloud (for example with Docker containers) it enables scalable setups.
Public IP addresses in detail
With the basics in place, public IP addresses are the next layer. They are your visible presence on the internet and the key to talking to the outside world. As a beginner you may ask why not every address is public — think of the apartment analogy: the street address is visible to everyone, the internal room numbers stay hidden. Public IPs are like that street address: unique worldwide and reachable directly. The next sections break that down: definition, properties, how they are assigned, and practical examples you can apply as a Linux sysadmin.
Definition and properties
A public IP address is the global identifier of your network on the internet. It is assigned by your Internet Service Provider (ISP) and is unique worldwide, so no other device has the same address. Unlike private IPs, which only work in your local net, public IPs can be routed across the entire internet. Packets from anywhere in the world can find their way to that address.
The main characteristics are:
- 1. Uniqueness: each public IP exists only once globally. That prevents mix-ups — imagine two houses with the same address, the post would be lost. The Internet Assigned Numbers Authority (IANA) oversees assignment to avoid conflicts.
- 2. Reachability: public IPs are accessible from anywhere. When you open a website, you send requests to the server’s public IP. Without that, online banking or shopping would be impossible.
- 3. Routability: routers on the internet know how to forward packets to public IPs. That is based on routing protocols such as BGP (Border Gateway Protocol), which find the best path.
For IPv4 and IPv6 the formats differ, but the principles stay the same. A public IPv4 might be 203.0.113.17, while an IPv6 address looks like 2001:db8::ff00:42:8329. Many ISPs now assign dual-stack addresses, both variants.
❗ Important note: Not every device needs its own public IP. In most cases your entire home net shares a single public IP through the router — more on that in the NAT section.
To visualise that, here is a diagram of internet communication with public IPs:
+-------------------------------------------------------------+
│ Internet │
│ │
│ +-------+ +-------+ │
│ │ Bank │ │ Shop │ │
│ │ 80.1. │ │ 93.2. │ │
│ │ 1.1 │ │ 2.2 │ │
│ +-------+ +-------+ │
│ │ │ │
│ +----------+--------------+ │
│ │ │
│ Your router │
│ (public IP: 203.0.113.17) │
│ │
│ Like a postman who knows exactly where packets must go │
+-------------------------------------------------------------+
The communication path explained
+-------------------------------------------------------------+
│ Communication path │
│ │
│ 1. You open www.example.com │
│ └─► request to the public IP │
│ │
│ 2. The router forwards it │
│ └─► to your device │
│ │
│ 3. The reply comes back │
│ └─► over the same route │
│ │
│ Without a public IP: chaos │
+-------------------------------------------------------------+
💡 Tip for beginners: As a sysadmin in a small office you might need a public IP for a mail server. Without it nobody could send email to you.
Assignment of public IP addresses
Public IPs are not assigned at random, but by your ISP. The process usually runs via DHCP (Dynamic Host Configuration Protocol), which hands out addresses automatically. For servers or fixed setups you can request static IPs — they do not change, unlike dynamic ones that can change on every reconnect.
Step-by-step assignment:
- DHCP lease: your router connects to the ISP and receives an IP for a set time.
- Static assignment: for business customers the ISP assigns a fixed IP, often for a fee.
- WHOIS lookups: to find out who owns an IP, use WHOIS databases.
On Linux you can check your public IP without opening a browser. Use curl to query an external page:
curl ifconfig.me
Output: your public IPv4 address, for example 203.0.113.17.
For IPv6:
curl -6 ifconfig.co
That shows your global IPv6 address.
🔧 Practical example: You manage a Linux server in the cloud (for example at Hetzner or AWS). You assign a static public IP by changing the configuration file /etc/netplan/ (on Ubuntu). Example config:
network:
version: 2
renderer: networkd
ethernets:
eth0:
dhcp4: no
addresses: [203.0.113.17/24]
gateway4: 203.0.113.1
nameservers:
addresses: [8.8.8.8, 8.8.4.4]
Then apply with:
sudo netplan apply
Check with ip addr show eth0. That gives stable reachability, for example for a VPN server.
⚠️ Watch out: Dynamic IPs can change, which causes problems for services. Use services such as DynDNS to point a domain (for example
myserver.dyndns.org) at the current IP. On Linux install ddclient and configure/etc/ddclient.conf.
Applications and advantages
Public IPs are essential for services that must be reachable from outside.
Examples:
- Web server: your site runs on a Linux server with Apache or Nginx.
- Email server: with Postfix on Ubuntu you send and receive mail globally.
- VPN access: OpenVPN uses a public IP to build secure tunnels.
💡 Tip for beginners: As a sysadmin in a small office you might need a public IP for a mail server. Without it nobody could send email to you.
Practical example:
Set up a simple web server. Install Nginx:
sudo apt update
sudo apt install nginx
Start it:
sudo systemctl start nginx
Reachable from outside via your public IP: http://203.0.113.17. Test with curl http://localhost locally vs externally.
For IPv6 enable in /etc/nginx/sites-available/default:
listen [::]:80;
Risks and protective measures
Public IPs carry risk because they are exposed.
Common threats:
- Attacks: attackers scan IPs for weaknesses (for example open ports).
- DDoS attacks: flood your connection.
- Privacy: your IP reveals your ISP and a rough location — use VPNs to mask it.
Protection:
Firewalls are mandatory. On Linux use ufw (Uncomplicated Firewall):
sudo ufw allow 80/tcp # For HTTP
sudo ufw enable
Or nftables for advanced rules:
sudo nft add table inet filter
sudo nft add chain inet filter input { type filter hook input priority 0 \; policy drop \; }
sudo nft add rule inet filter input tcp dport 80 accept
❗ Important note: In clouds such as AWS use security groups to allow only certain IPs. As a beginner start with ufw — it is simple and effective.
Risks visualised
+-------------------------------------------------------------+
│ Internet (threats) │
│ +------+ +------+ +------+ │
│ │ Hack │ │ DDoS │ │ Scan │ │
│ +------+ +------+ +------+ │
│ │ │ │ │
│ +-----------+-----------+ │
│ │ │
│ Firewall (protection) │
│ +-----------+ │
│ │ Router │ │
│ +-----------+ │
│ │
│ Blocks unwanted access │
+-------------------------------------------------------------+
As a sysadmin in a company you monitor logs with tools such as fail2ban, which bans IPs after failed attempts.
Install it:
sudo apt install fail2ban
Configure /etc/fail2ban/jail.local for SSH protection.
With these details you understand public IPs better — they are the gate to the world, but with responsibility.
Private IP addresses and NAT
With public IPs in place, private IP addresses are the invisible backbone of your local network. These addresses stay inside your house or office and keep order without loading the global internet. As a beginner you will notice that most devices you use daily have private IPs, and NAT is the mechanism that connects them to the outside world. The path is systematic: first definition and ranges, then use in practice, then a deep explanation of NAT, its types and how you configure it on Linux.
Definition and properties
Private IP addresses are reserved for internal use in local networks (LANs). Unlike their public counterparts they are not globally routable — packets with private IPs cannot cross the internet directly. Instead they are used only inside your network, which makes them ideal for home or office environments. These addresses are not unique worldwide; your neighbour could have the same private IP on a device without a conflict, because they never leave the local net.
The idea comes from RFC 1918, a standard that sets certain ranges for private use. That conserves scarce public addresses and raises security, because external devices cannot open direct connections to your private IPs.
In IPv4 there are three main blocks:
10.0.0.0to10.255.255.255(10.0.0.0/8) — perfect for large nets, such as companies with thousands of devices.172.16.0.0to172.31.255.255(172.16.0.0/12) — mid-sized nets, often in company departments.192.168.0.0to192.168.255.255(192.168.0.0/16) — the classic for home networks.
For IPv6 there are Unique Local Addresses (ULAs) in the range fc00::/7, which work similarly, with the advantage of vast address space. They often start with fd and are meant for local communication without global routability.
❗ Important note: Private IPs are free and unlimited to use, but they need a router to talk to the internet. Without NAT (more on that in a moment) you are isolated.
To find your private IP on Linux, look in the output of:
ip addr show
Search for inet on your local interface, for example 192.168.1.10. That is typical for a home net.
Private IP ranges (IPv4)
+-------------------------------------------------------------+
│ Private IPv4 ranges (RFC 1918) │
│ │
│ 10.0.0.0/8 16,777,216 large nets │
│ 172.16.0.0/12 1,048,576 mid-size nets │
│ 192.168.0.0/16 65,536 home nets │
+-------------------------------------------------------------+
IPv6 equivalent
+-------------------------------------------------------------+
│ IPv6 Unique Local Addresses │
│ │
│ fc00::/7 infinitely many, locally usable │
│ Example: fd12:3456:789a::/48 for one net │
+-------------------------------------------------------------+
💡 Tip for beginners: When you set up a new net, start with
192.168.0.0/16— it is simple and covers up to 65,000 devices, more than enough at home.
Use in local networks
Private IPs are used in every LAN, from your living room to large companies. In a home network the router (for example a Fritz!Box) assigns private addresses automatically — your PC might get 192.168.1.10, your smartphone 192.168.1.20. That enables internal communication such as file shares or printer access without data leaving the house.
As a sysadmin in an office you might use private IPs per department: IT on 10.1.0.0/24, marketing on 10.2.0.0/24. That simplifies administration and improves security through subnets. In container environments such as Docker, virtual nets often get private IPs, for example 172.17.0.0/16 for Docker bridges.
🔧 Practical example: Configure a static private IP on Linux to avoid conflicts. Edit /etc/network/interfaces (on Debian-based systems):
auto eth0
iface eth0 inet static
address 192.168.1.50
netmask 255.255.255.0
gateway 192.168.1.1
dns-nameservers 8.8.8.8
Then restart with:
sudo ifdown eth0 && sudo ifup eth0
Or with Netplan on Ubuntu:
network:
version: 2
ethernets:
eth0:
dhcp4: false
addresses: [192.168.1.50/24]
gateway4: 192.168.1.1
nameservers:
addresses: [8.8.8.8]
Apply:
sudo netplan apply
For IPv6 assign a ULA:
sudo ip -6 addr add fd12:3456:789a::2/64 dev eth0
🔧 Practical example: In a small server room you set up a NAS with Samba. All clients have private IPs in the 10.0.0.0 range. Test reachability with ping:
ping 10.0.0.5
If it fails, check the route with:
ip route show
That shows whether your net is routed correctly.
⚠️ Watch out: Avoid overlaps — if two nets use the same private range (for example on VPNs), conflicts occur. Choose different subnets.
Local network example
+-------------------------------------------------------------+
│ Home network │
│ Router: 192.168.1.1 │
│ │
│ +------+ +------+ +------+ │
│ │ PC │ │ Tab │ │ Phone│ │
│ │ .10 │ │ .20 │ │ .30 │ │
│ +------+ +------+ +------+ │
│ │
│ Internal communication: fast and safe │
+-------------------------------------------------------------+
NAT: the bridge between private and public
NAT (Network Address Translation) is the translator that connects private IPs with public ones. It changes the IP addresses in packet headers so your local net appears as a single public IP. Without NAT, private devices could not reach the internet — it is like a porter who readdresses internal mail for the outside.
How it works, step by step:
1. Outbound traffic:
Your PC (private IP 192.168.1.10) sends a packet to google.com. The router replaces the source IP with its public one (203.0.113.17) and remembers the port (for example via PAT — Port Address Translation).
2. Inbound traffic:
The reply arrives at the public IP. The router looks in its NAT table and forwards it to the private IP.
3. Session tracking:
NAT tracks connections to match packets — that is stateful.
Types of NAT:
- Static NAT: a fixed mapping, for example private
192.168.1.10to public203.0.113.18 - Dynamic NAT: switches IPs from a pool — rare at home
- PAT (overloading): the most common form; several private IPs share one public IP, distinguished by ports.
In IPv6, NAT is less necessary because addresses are plentiful, but NPT (Network Prefix Translation) translates prefixes for multi-homing.
Configuration on Linux:
Use iptables (older) or nftables (more modern). For a simple NAT setup (for example a router with two interfaces: eth0 to the internet, eth1 to the LAN):
First enable IP forwarding:
echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
Or permanently in /etc/sysctl.conf: net.ipv4.ip_forward=1, then sudo sysctl -p.
With nftables:
sudo nft add table nat
sudo nft add chain nat postrouting { type nat hook postrouting priority 100 \; }
sudo nft add rule nat postrouting oifname "eth0" ip saddr 192.168.1.0/24 masquerade
That masquerades (PAT) for the LAN.
For static NAT:
sudo nft add rule nat postrouting ip saddr 192.168.1.10 snat to 203.0.113.18
sudo nft add rule nat prerouting ip daddr 203.0.113.18 dnat to 192.168.1.10
Test with traceroute from a LAN device:
traceroute 8.8.8.8
That shows the path via the router.
In Docker:
Container nets use NAT automatically. Create a net:
docker network create --subnet=172.18.0.0/16 mynet
Docker bridges that with NAT.
🔧 Practical example: You build a home router with Ubuntu. Install dnsmasq for DHCP (to assign private IPs):
sudo apt install dnsmasq
Configure /etc/dnsmasq.conf:
interface=eth1
dhcp-range=192.168.1.50,192.168.1.150,12h
Start:
sudo systemctl restart dnsmasq
For IPv6 NAT (NPT) use ip6tables, but test first whether you need it — many nets run natively.
⚠️ Watch out: Wrong NAT can block connections. Monitor with:
sudo nft list ruleset
Or tcpdump for packets:
sudo tcpdump -i eth0 -n icmp
How NAT works:
+-------------------------------------------------------------+
│ Private net Internet │
│ │
│ +------+ │
│ │ PC │ --> Router --> NAT --> Server │
│ │192. │ (translates IP) │
│ │168.1 │ │
│ │.10 │ <-- reply <-- NAT <-- Server │
│ +------+ (reverse translation) │
│ │
│ Like an interpreter for addresses │
+-------------------------------------------------------------+
NAT types:
+-------------------------------------------------------------+
│ NAT types │
+----------------+--------------------------------------------+
│ Type │ Description │
+----------------+--------------------------------------------+
│ Static NAT │ Fixed 1:1 mapping │
│ Dynamic NAT │ From a pool, temporary │
│ PAT │ Many to one, with ports │
+-------------------------------------------------------------+
Practical application
Troubleshooting and resources
Now that you understand private IPs and NAT, this is the hands-on part.
How do you apply all of this in practice? As a beginner you will learn to check your IPs, monitor networks and solve problems — all with Linux tools you can try immediately. The next sections cover checks, typical faults with detailed fix steps and useful resources so you can continue independently as a sysadmin. Practise in a safe environment, for example in a virtual machine with VirtualBox.
Checking and tools on Linux
The first practical step is to identify your IPs and analyse the network. Linux offers powerful commands that show you whether everything is running correctly. Always start with an overview of your interfaces.
To check private and public IPs:
For local (usually private) IPs:
ip addr show
That lists all interfaces with their IPs. Watch inet for IPv4 and inet6 for IPv6. In a home net you typically see private addresses such as 192.168.1.x here.
For the public IP:
curl ifconfig.me
Or for IPv6:
curl -6 ifconfig.co
That fetches the info from outside, because your system does not know the public IP directly — it sits on the router.
🔧 Practical example: You manage a small server on your home net. Check the route to external destinations with:
ip route show
That shows the default gateway (for example 192.168.1.1), which handles NAT.
For detailed paths use:
traceroute google.com
Or for IPv6:
traceroute6 ipv6.google.com
That visualises how packets run through NAT and routers.
Further tools for deeper analysis:
nmap: scan your net for devices with private IPs.
Install with:
sudo apt install nmap
Then scan:
sudo nmap -sn 192.168.1.0/24
That lists all active hosts — useful to see which devices are online.
ss monitors sockets and connections to check whether NAT is translating correctly.
ss -tuln
That shows open ports; look for external connections that run through NAT.
curl tests reachability.
For a private IP internally:
curl http://192.168.1.10
Externally that fails, which demonstrates the isolation.
For Docker environments, where containers use private nets
Inspect a net with:
docker network inspect bridge
That shows subnets such as 172.17.0.0/16 and how Docker uses NAT.
💡 Tip for beginners: Combine tools for monitoring. Write a script that checks IPs and notifies you by email.
Example in Bash:
#!/bin/bash
PUBLIC_IP=$(curl -s ifconfig.me)
echo "Your public IP: $PUBLIC_IP" | mail -s "IP-Check" you@example.com
Make it executable with chmod +x script.sh and schedule it with cron: crontab -e, add @daily /path/to/script.sh.
Network check
+-------------------------------------------------------------+
│ Linux system │
│ │
│ +------+ │
│ │ ip │ --> addr / route show │
│ +------+ │
│ │
│ +------+ │
│ │ curl │ --> public IP │
│ +------+ │
│ │
│ +------+ │
│ │ nmap │ --> net scan │
│ +------+ │
│ │
│ Fast diagnostic tools │
+-------------------------------------------------------------+
Common problems and solutions
Network problems occur often, especially when IPs are configured wrongly. Here are the most common ones for beginners, with stepwise solutions — always work systematically:
Check layer by layer (physical, link, IP).
Problem 1: no network connection
Symptoms: no ping to internal or external destinations.
Solution steps:
1. Physical check: make sure cables are plugged in or Wi-Fi is connected. On Linux:
ip link show
Look for "state UP" — if DOWN:
sudo ip link set eth0 up
2. Check IP assignment:
No IP? Shows as a missing inet entry.
ip addr show eth0
If APIPA (169.254.x.x) DHCP failed.
Renew:
sudo dhclient -r eth0 && sudo dhclient eth0
- Test the gateway:
Ping the router (private IP, for example 192.168.1.1).
ping 192.168.1.1
No success? Check cables or restart the router.
For IPv6: check with ping6 fe80::1%eth0 (link-local).
⚠️ Watch out: In virtual environments such as KVM, bridging may be wrong. Configure
/etc/netplanwith a bridge setup and apply.
No connection
+-------------------------------------------------------------+
│ No connection │
│ │
│ ✗ DOWN │
│ └─► check the cable │
│ └─► ip link set up │
│ │
│ ✗ No IP │
│ └─► renew dhclient │
│ └─► 169.254.x.x = DHCP failure │
│ │
│ Fix it step by step │
+-------------------------------------------------------------+
Problem 2:
NAT does not work (no internet despite a local connection)
Symptoms: internal pings work, external ones do not.
Solution steps:
- Check forwarding:
cat /proc/sys/net/ipv4/ip_forward
Should be 1; otherwise set with echo 1 > /proc/sys/net/ipv4/ip_forward.
- Check NAT rules:
With nftables:
sudo nft list ruleset
If missing, add them as above.
- Firewall rules:
Ufw might be blocking.
sudo ufw status
Allow forwarding: sudo ufw allow from 192.168.1.0/24 to any. In Docker: check iptables conflicts with sudo iptables -t nat -L -n -v.
🔧 Practical example: On a company net with VPN, NAT blocks access. Use tcpdump to debug:
sudo tcpdump -i eth1 -n host 192.168.1.10 and port 80
That shows packets before/after NAT.
Problem 3:
DNS problems (name resolution fails)
Symptoms: IPs ping, but domains do not (for example ping 8.8.8.8 works, ping google.com does not).
Solution steps:
- Check resolv.conf:
cat /etc/resolv.conf
Should have nameserver 8.8.8.8 or the router IP.
- Test DNS:
nslookup google.com
If it fails, set it temporarily:
echo "nameserver 8.8.8.8" | sudo tee /etc/resolv.conf
- systemd-resolved:
On modern distros:
systemd-resolve --status
Flush cache: sudo systemd-resolve --flush-caches. For IPv6 DNS: use 2001:4860:4860::8888.
❗ Important note: In containers Docker overwrites DNS — set it in
docker run --dns=8.8.8.8.
DNS troubleshooting
+-------------------------------------------------------------+
│ DNS troubleshooting │
│ │
│ 1. Check resolv.conf │
│ └─► enter a nameserver │
│ │
│ 2. Test nslookup │
│ └─► resolve the domain │
│ │
│ 3. Flush the cache │
│ └─► systemd-resolve │
│ │
│ Like updating a phone book │
+-------------------------------------------------------------+
Problem 4:
IPv6-specific issues
Symptoms: IPv4 works, IPv6 does not. Fix: enable in /etc/sysctl.conf: net.ipv6.conf.all.disable_ipv6=0, then sudo sysctl -p. Test with ping6 ipv6.google.com.
In NAT setups:
Configure NPT with ip6tables analogously to IPv4.
💡 Tip: Log errors with journalctl:
journalctl -u NetworkManager -f
That shows problems in real time.
Important resources
To go deeper, here are selected tools and docs:
Useful Linux tools:
Official documentation:
- Man pages:
man ip,man nft. - IANA: IP ranges.
- Netfilter: firewall docs.
Online tools:
With these resources you are equipped — try them and build on the knowledge.
Command Reference (Cheatsheet)
The following reference collects the essential commands for checking public and private IPs, NAT and typical faults:
| Category | Command | Purpose |
|---|---|---|
| Status | ip addr show |
Shows IPv4 (inet) and IPv6 (inet6) on all interfaces |
| Status | ip addr show eth0 |
Limits the view to one interface |
| Status | ip link show |
Shows whether an interface is UP or DOWN |
| Status | ip route show |
Shows routes and the default gateway |
| Public IP | curl ifconfig.me |
Queries the public IPv4 address |
| Public IP | curl -6 ifconfig.co |
Queries the global IPv6 address |
| Forwarding | cat /proc/sys/net/ipv4/ip_forward |
Checks whether IPv4 forwarding is on |
| Forwarding | echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward |
Enables forwarding at runtime |
| NAT | sudo nft list ruleset |
Lists nftables NAT and filter rules |
| NAT | sudo nft add rule nat postrouting oifname "eth0" ip saddr 192.168.1.0/24 masquerade |
PAT/masquerade for a LAN |
| Reachability | ping 192.168.1.1 |
Tests the local gateway |
| Reachability | traceroute 8.8.8.8 |
Shows the path through NAT to the internet |
| Reachability | traceroute6 ipv6.google.com |
IPv6 path |
| Scan | sudo nmap -sn 192.168.1.0/24 |
Lists live hosts in the private net |
| Sockets | ss -tuln |
Shows listening ports |
| Capture | sudo tcpdump -i eth0 -n icmp |
Watches ICMP through NAT |
| DHCP | sudo dhclient -r eth0 && sudo dhclient eth0 |
Renews a DHCP lease |
| DNS | nslookup google.com |
Tests name resolution |
| DNS | systemd-resolve --status |
Shows the systemd-resolved state |
| Firewall | sudo ufw allow 80/tcp |
Opens HTTP in ufw |
| Docker | docker network inspect bridge |
Shows the Docker bridge subnet and NAT |
Further Resources
For deeper reading and further references, the following links give direct access to standards, tools and related articles:
| Resource | Description | Type |
|---|---|---|
| RFC 1918 | Official private IPv4 ranges 10/8, 172.16/12 and 192.168/16 |
RFC |
| IANA IPv4 special registry | Special-use IPv4 blocks including private and link-local | Registry |
| Netfilter / nftables | NAT, masquerade, SNAT/DNAT and filter chains | Documentation |
| ifconfig.me | Quick lookup of the public address seen from outside | Tool |
| ipinfo.io | WHOIS-style lookup for ISP and geolocation of an IP | Tool |
| Dynamic vs static IP addresses | DHCP vs manual addressing and how you configure both on Linux | Article |
| OSI model | Layer 3 routing context for IP addresses | Article |
Conclusion
After walking through IP basics, public IPs as global gates, private IPs with NAT as a safe local base, and practical tools plus troubleshooting, the picture is clear: the split between public and private IP addresses is the heart of modern networks. It provides efficiency, conserves resources and protects against threats — whether on your home net or as a sysadmin in the cloud.
As a beginner take this with you: public IPs connect you to the world, private ones keep your LAN organised, NAT translates between them. With commands such as ip addr show or nft list ruleset you stay in control. Try it, for example with your own NAT setup, to lock in what you learned.
❗ Important note: Keep going — from here paths lead to IPv6 migration, firewall tuning or container networks in Docker. The networking world changes, but these basics remain your foundation.
⚠️ Networking keeps evolving, but these foundations stay and form the base for further topics such as IPv6, network security or container networking.