IPv4 vs IPv6 Architecture, NAT Traversal & Public vs Private IP

The Internet Protocol (IP) serves as the primary network layer addressing system governing routing across the global Internet. IPv4, standardized in 1981 via RFC 791, utilizes a 32-bit address space represented as four decimal octets separated by dots (192.0.2.1). This provides a theoretical maximum of approximately 4.29 billion distinct addresses—a pool that was officially exhausted by IANA in 2011.

To accommodate the explosion of smartphones, cloud containers, and IoT devices, IETF introduced IPv6 (RFC 8200). IPv6 expands the address width to 128 bits, represented as eight groups of four hexadecimal digits separated by colons (2001:0db8:85a3:0000:0000:8a2e:0370:7334). This provides an astronomical address pool of approximately 3.4 × 10^38 unique addresses—enough to assign trillions of addresses to every grain of sand on Earth.

Modern networks organize IP address spaces using Classless Inter-Domain Routing (CIDR) (RFC 4632). A CIDR notation pairs an IP address with a forward slash and prefix length, denoting how many leading bits represent the network routing prefix:

• /24 Subnet (256 addresses): Common in local networks (e.g., 192.168.1.0/24). 24 bits designate the network; 8 bits designate host addresses (254 usable hosts after subtracting network and broadcast addresses).
• /16 Subnet (65,536 addresses): Common in enterprise VPC cloud configurations (e.g., AWS VPC 10.0.0.0/16).
• /32 Notation: Represents a single, specific host address.

To slow IPv4 exhaustion, RFC 1918 reserved three private IP ranges for non-routable local area networks:

• 10.0.0.0 – 10.255.255.255 (10.0.0.0/8)
• 172.16.0.0 – 172.31.255.255 (172.16.0.0/12)
• 192.168.0.0 – 192.168.255.255 (192.168.0.0/16)

Because these addresses cannot traverse public Internet backbones, home routers and corporate gateways utilize Network Address Translation (NAT). NAT transparently modifies the source IP and source port in packet headers, allowing hundreds of internal devices to share a single public IP address.

When an end user accesses a web application behind a CDN (such as Cloudflare) or load balancer (such as AWS ALB), the server's raw socket sees only the IP address of the reverse proxy, not the client.

Reverse proxies forward the actual client IP using HTTP headers such as X-Forwarded-For: client, proxy1, proxy2 or CF-Connecting-IP. However, if backend applications blindly trust X-Forwarded-For without validating that the request arrived from a trusted reverse proxy IP range, malicious clients can spoof their IP address by injecting forged headers to bypass rate limits and geographic firewalls.

Even when the request does come from your proxy, the left-most X-Forwarded-For entry is still whatever the client sent: each proxy only appends the address it saw. Read the list from the right and take the first address that is not one of your own proxies.

// Securely extracting client IP in Node.js behind trusted proxies
export function getClientIp(req, trustedProxyIps) {
    const remoteSocketIp = req.socket.remoteAddress;

    // Only trust headers if the direct socket connection is from our known proxy
    if (!trustedProxyIps.includes(remoteSocketIp)) {
        return remoteSocketIp;
    }

    // Each proxy appends to X-Forwarded-For, so the left-most entries are
    // whatever the client sent. Walk from the right and return the first
    // hop that is not one of our own proxies.
    const hops = (req.headers['x-forwarded-for'] || '')
        .split(',')
        .map((ip) => ip.trim())
        .filter(Boolean);
    for (let i = hops.length - 1; i >= 0; i--) {
        if (!trustedProxyIps.includes(hops[i])) {
            return hops[i];
        }
    }
    return remoteSocketIp;
}

WebRTC (Web Real-Time Communication) establishes peer-to-peer browser video and data streams. To establish direct UDP connections behind NAT, WebRTC uses the STUN protocol to gather Interactive Connectivity Establishment (ICE) candidates.

Historically, this mechanism leaked a user's true local private IP (and even real public IP when using a commercial VPN) to any untrusted website running a JavaScript snippet. Modern browsers now protect users by obfuscating local IP candidates with mDNS (Multicast DNS) hostname identifiers. Test your connection details using the DevUtils My IP tool.