Reserved IP Address Ranges
The special-purpose IPv4 and IPv6 ranges in one table: private networks, loopback, link-local, CGNAT, documentation, multicast and more, with what each is for.
Free · No sign-up · Your inputs stay in your browser
Reference
Reserved and special-purpose IP ranges
| Block | Purpose | Notes |
|---|---|---|
| 0.0.0.0/8 | This network | 0.0.0.0 as a listen address means every interface. |
| 10.0.0.0/8 | Private (RFC 1918) | Not routed on the internet. |
| 100.64.0.0/10 | Carrier-grade NAT (RFC 6598) | Shared address space between ISP and customer; also Tailscale's range. |
| 127.0.0.0/8 | Loopback | The whole /8, not just 127.0.0.1. |
| 169.254.0.0/16 | Link-local (RFC 3927) | Self-assigned when DHCP fails. 169.254.169.254 is the cloud metadata service: block it from SSRF. |
| 172.16.0.0/12 | Private (RFC 1918) | 172.16.0.0 to 172.31.255.255. Docker's default bridge networks live here. |
| 192.0.0.0/24 | IETF protocol assignments | |
| 192.0.2.0/24 | Documentation (TEST-NET-1) | Use in examples; never routed. |
| 192.88.99.0/24 | Deprecated 6to4 relay anycast | |
| 192.168.0.0/16 | Private (RFC 1918) | Home and office networks. |
| 198.18.0.0/15 | Benchmarking (RFC 2544) | |
| 198.51.100.0/24 | Documentation (TEST-NET-2) | |
| 203.0.113.0/24 | Documentation (TEST-NET-3) | |
| 224.0.0.0/4 | Multicast | 224.0.0.251 is mDNS. |
| 240.0.0.0/4 | Reserved for future use | Unusable on most stacks. |
| 255.255.255.255/32 | Limited broadcast | |
| ::/128 | Unspecified (IPv6) | Like 0.0.0.0. |
| ::1/128 | Loopback (IPv6) | |
| ::ffff:0:0/96 | IPv4-mapped IPv6 | ::ffff:203.0.113.10 is how a dual-stack socket shows an IPv4 client. |
| 64:ff9b::/96 | NAT64 well-known prefix (RFC 6052) | |
| 100::/64 | Discard-only (RFC 6666) | |
| 2001::/32 | Teredo | |
| 2001:db8::/32 | Documentation (IPv6) | Use in examples. |
| 2002::/16 | 6to4 | Deprecated. |
| fc00::/7 | Unique local addresses (RFC 4193) | IPv6's private range; in practice fd00::/8 with a random 40-bit ID. |
| fe80::/10 | Link-local (IPv6) | Every interface has one; needs a %interface zone to use. |
| ff00::/8 | Multicast (IPv6) | ff02::1 is all nodes on the link. |
From the IANA IPv4 and IPv6 special-purpose address registries. When validating user-supplied URLs against SSRF, reject every range here, not only 127.0.0.1 and RFC 1918, and resolve the hostname before checking, since a DNS name can point at any of them.
About this tool
Method, assumptions, practical next steps, and limits.
SSRF filters need the whole list
An application that fetches user-supplied URLs must refuse internal addresses, and a filter that blocks only 127.0.0.1 and 10.0.0.0/8 misses 169.254.169.254 (cloud credentials), 100.64.0.0/10, IPv6 loopback, IPv4-mapped IPv6 and more. Resolve the hostname first and check the resulting address, since DNS can point anywhere. The registries are maintained by IANA.
Examples that never collide
Documentation and test code should use 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 and 2001:db8::/32, which are reserved for exactly that and never routed.