Start an order
Technical guide • Network fundamentals

Addresses for
your business.

A practical guide to public and private IP addresses, static assignments, subnets, gateways, and IPv6.

Prepared by Stealth CommunicationsNovember 1, 2026Approx. 8 min read

The short version

What does an IP address do?

An Internet Protocol address helps networks deliver traffic to an endpoint. A business may use public addresses to communicate over the Internet and private addresses inside its office. The addresses themselves do not establish that an application is reachable or secure: routing, firewall policy, and the application also matter.

A useful starting point

List the services that need an address people can reach or recognize, then agree on the addressing, routing, and security with your network team and provider.

An address is different from a domain name. DNS can map a name to one or more addresses; the mapping can change without changing the name.

01 / Address types

Public outside. Private inside.

Publicly routable addresses can be advertised and reached across the Internet when routing and security policy permit. They may identify a connection, a VPN gateway, a website, or another service. Having an address alone does not guarantee it can be reached.

Many offices use private IPv4 addresses, such as those in 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16, for internal devices. These ranges are reused by many organizations and are not globally routed on the public Internet. Only the listed portion of 172 is private; not every address starting with 172 is private.

Check for overlap. Two offices or VPN-connected businesses that use the same private subnet may need a network redesign or translation before they can communicate reliably.

02 / Address assignment

Static or dynamic?

A static address is intended to remain assigned for the relevant service or period agreed with the provider. A dynamic address can change. Both can work for ordinary browsing and cloud applications; the appropriate choice depends on the services and how they are managed.

VPN access

A stable address can make it easier to configure remote access and connections between offices.

Allowlisting

A partner may permit traffic only from an approved address or range. Confirm both IPv4 and IPv6 sources where applicable.

Hosted services

An application hosted at the office may need inbound routing, DNS, and carefully scoped firewall rules.

Change planning

A stable address reduces routine updates, but it can still change when service or network arrangements change.

Ask whether addresses are assigned from the provider’s space or held independently, and what happens if you change providers. Do not assume an assigned address can move with you.

03 / The terms

Subnet, prefix, and gateway.

A subnet groups addresses for a network. A prefix length, written after a slash, describes how much of an address identifies that network. The gateway is typically the next router a device sends traffic to when the destination is outside its local subnet.

For an illustration, a provider might supply 192.0.2.2/30 for the customer interface and 192.0.2.1 as the gateway. The /30 identifies a four-address IPv4 block; in this conventional example two addresses are used by the endpoints. The 192.0.2.0/24 range is reserved for documentation, so do not use these numbers on a live Internet service.

Not every connection uses a /30. A supported point-to-point /31 can use both addresses as endpoints, and a provider may route additional addresses to the customer separately. Use the actual provider handoff sheet instead of guessing from an example. For the physical connection and service boundary, see the Internet handoff guide.

04 / How traffic leaves

What does NAT do?

Network address translation, or NAT, changes address information as traffic crosses a device. A common IPv4 setup lets many private office devices share a public IPv4 address for outbound traffic. The firewall tracks connections so replies can reach the right internal device.

Publishing an internal service may involve destination NAT or port forwarding, routing, and explicit firewall rules. It also creates an Internet-facing service that needs maintenance and protection. A VPN, reverse proxy, or hosted service may be a better fit; choose based on the application and your security requirements.

Some designs use routed public address blocks directly rather than NAT. A public address can be configured on a firewall or routed through it to another network. Confirm the exact design, including the next hop and return path, with the provider.

05 / IPv6

Plan for both address families.

IPv6 uses a different, larger address format. A business may receive an IPv6 prefix from its provider and assign addresses to networks and devices from it. The provider and your equipment determine how the prefix and gateway are delivered.

IPv6 is not simply a longer IPv4 address, and it does not require NAT to provide the same kind of address conservation. A globally scoped IPv6 address still needs an appropriate firewall policy; global addressing does not mean unsolicited inbound traffic should be allowed. Test IPv4 and IPv6 independently where both are enabled.

DNS uses A records for IPv4 and AAAA records for IPv6. For more about resolution and public resolvers, see our business DNS guide.

06 / Operations

Keep an address change from becoming an outage.

Before changing providers, equipment, or addressing, inventory dependencies: DNS records, VPN peers, partner allowlists, inbound application rules, monitoring systems, and certificates or management tools that refer to an address. Consider both inbound and outbound traffic, including public IPv6.

Agree on a change window, test plan, and rollback. Update records and third-party allowlists with enough lead time, then validate from outside the network as well as from the office. Existing sessions may need to reconnect. Record who manages each part and whom to contact if it fails.

Do not treat NAT as a firewall. Restrict inbound and outbound traffic with an explicit security policy, maintain devices and applications, and monitor the services you expose.

07 / Planning checklist

Questions for your provider and IT team.

  • Which IPv4 and IPv6 addresses or prefixes are assigned, and are they static?
  • What address, prefix, and gateway belong on the connection to the provider?
  • Are additional addresses routed to us separately? What next hop is used?
  • Are the addresses tied to this provider, and what happens if service changes?
  • Which VPNs, hosted applications, DNS records, and partner allowlists depend on them?
  • Which addresses and ports need inbound access, and who maintains the firewall policy?
  • How will IPv4 and IPv6 connectivity, security, and failover be tested?
  • Who can make a change, and what is the rollback plan?

About this brief

Sources and further reading.

These references cover the address types and standards discussed here. The actual assignment and configuration depend on the network and provider.

Address fundamentals

Public and private space

Standards

Subnets and IPv6

Prepared by Stealth Communications, a provider of business connectivity. Examples use documentation addresses; they are not service configuration instructions.