Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is the difference between a private IP and a public IP?
Short answer
Private IPs are the addresses reserved for internal networks and not routed on the internet; in IPv4, these ranges are defined in RFC 1918: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. A public IP, on the other hand, is an address that is routed on the internet and allocated exclusively to its owner. For a device with a private address to communicate with the internet, its address must be translated to a public address with NAT. In TR7, this distinction is seen most in the Local Networks entry: in Firewall rules, Local Networks in the Source = Country list selects, with a single entry, the special-purpose and local IPv4 ranges, which also include the private ranges; the same entry is present by default in the DDoS Whitelist and exempts the traffic coming from the internal network from the L4 DDoS measures.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Network → Firewall → Add | Source = Country → Local Networks (the Country mode comes filled with this entry); it can also be selected with Destination IP = Country | Applying the rule to the traffic coming from (or going to) special-purpose and local ranges |
| The L4 DDoS Management screen of the route table | DDoS Whitelist → the Local networks (XX) entry | Exempting special-purpose and local sources from the L4 DDoS measures (default entry; can be deleted) |
| Settings → Device Management → HA Clustering & Sync → Edit (on Azure, while Clustering enabled is on) | Peer Device Private IP (cloud) | The primary private IP of the peer device for management purposes (not the sync interface address); setup steps: Is TR7 itself a single point of failure; how do I set up Load Balancer redundantly? |
Comparison
| Private IP | Public IP | |
|---|---|---|
| Is it routed on the internet | No | Yes |
| Uniqueness | Only within its own network | Across the internet |
| Going out to the internet | By being translated to a public address with NAT | Directly |
| Typical use in TR7 | Backend Service addresses, cluster Interface IPs, management network | The Frontend IP of a vService opened to the internet, or the NAT address in front of it |
Common Misconceptions
- "Traffic coming from a private IP is safe; it is not inspected." A private address determines only routability; Firewall rules and L4 DDoS measures can be applied to internal network traffic too. If the Local Networks entry is deleted from the DDoS Whitelist, the internal network sources also become subject to the L4 DDoS rules.
- "A separate public IP is needed for each website." More than one site can be published behind a single public IP (Can I publish more than one website behind a single public IP?).
- "Users behind NAT appear with different addresses." They share the same public outgoing address; persistence based on the source IP counts them as a single client (All users coming from behind a corporate NAT go to a single server; why?).
How it is done in the documentation
