Private networks rely heavily on specific blocks of internet protocol addresses to isolate local devices from the public internet. If you're configuring a home network, a corporate office, or a virtual private cloud, you'll inevitably bump into the middle tier of private IPv4 ranges.
IP class 172 addresses refer to the Class B private address space spanning from 172.16.0.0 to 172.31.255.255. Defined under RFC 1918 by the Internet Engineering Task Force, this block provides over one million unique private host identifiers. Routers configured with Network Address Translation drop these packets at the gateway, meaning devices using this range cannot be reached directly from the public web without a port forwarding rule or a proxy.
Understanding IPv4 Private Address Blocks
Before modern CIDR notation replaced rigid classful networking, IP architecture divided addresses into distinct classes based on the first few bits of the first octet. Class A, B, and C networks defined strict default subnet masks and host limits. While classful networking is obsolete in modern routing, people still use the terminology out of habit.
The three designated private IPv4 blocks serve a single purpose: conserving public IPv4 address space by allowing organizations to reuse the same local numbers internally.
- Class A Private Range: 10.0.0.0 to 10.255.255.255, supporting massive enterprise networks with up to 16 million hosts.
- Class B Private Range: 172.16.0.0 to 172.31.255.255, offering a balanced middle tier for medium-to-large corporate environments.
- Class C Private Range: 192.168.0.0 to 192.168.255.255, commonly found in home routers and small office environments.
The 172 range sits right in the middle. It gives network administrators breathing room when a small Class C network with its 256-address limit falls short, but it avoids the massive administrative overhead of managing a full Class A block.
The Structure of the 172.16.0.0/12 Range
The 172 range isn't just a single Class C network; it's actually a block of sixteen contiguous Class B networks combined. In CIDR notation, it's written as 172.16.0.0/12.
The first two octets of any address in this block always start with 172, followed by a second octet ranging from 16 to 31 in decimal. Translated to binary, the first 12 bits are fixed as 10101100 0001. The remaining 20 bits are available for network subnets and individual host addresses.
- Total IP Addresses: 1,048,576
- Default Subnet Mask: 255.240.0.0
- First Usable Address: 172.16.0.1
- Broadcast Address: 172.31.255.255
Because of this flexibility, network engineers can slice this block into dozens of smaller subnets for different departments, VLANs, or remote branch offices without running out of local identifiers.
Practical Subnetting Examples for the 172 Range
When you set up a local area network using this block, you rarely use the entire /12 range flat. Instead, you carve it up into smaller subnets using custom subnet masks. Let's look at a few practical examples.
Example 1: Standard Medium Office Setup (/24)
Suppose you need a standard network for a branch office with roughly 200 devices. You can assign a standard /24 subnet from within the pool, such as 172.16.10.0 with a subnet mask of 255.255.255.0.
- Network ID: 172.16.10.0
- Usable Host Range: 172.16.10.1 to 172.16.10.254
- Broadcast Address: 172.16.10.255
This gives you 254 usable IP addresses for workstations, printers, and switches, leaving the network ID and broadcast address reserved.
Example 2: Segmented Corporate VLANs (/22)
If your organization requires a larger single broadcast domain for up to 1,000 devices, you can use a /22 mask like 255.255.252.0.
- Network ID: 172.16.20.0
- Usable Host Range: 172.16.20.1 to 172.16.23.254
- Total Usable Hosts: 1,022
By moving the CIDR boundary, you group four traditional Class C networks together into a single broadcast domain. For more details on how these calculations work, review the Internet Assigned Numbers Authority documentation.
Common Configuration Mistakes
Mistakes in network design can lead to IP conflicts, routing loops, and security vulnerabilities. Avoiding these common pitfalls keeps your infrastructure stable.
- Treating 172 as routable on the public web: Because these addresses are private, internet service providers drop any traffic originating from or destined to a 172.16.x.x address. You must use NAT on your firewall to translate private addresses to a public static IP before data hits the internet.
- Choosing overlapping subnets for VPN tunnels: If your main office uses
172.16.10.0/24and you try to connect a remote site that also uses172.16.10.0/24via a site-to-site VPN, routing breaks down because the router doesn't know which path to take. Always map out a unique IP allocation plan across all branch locations. - Confusing the range boundaries: Remember that only the block from
172.16.0.0to172.31.255.255is private. An address like172.32.0.1is a publicly routable IP address owned by an external entity. Accidentally using public IP space for internal devices causes erratic connectivity issues.
Frequently Asked Questions
Can I use a 172 address for my home Wi-Fi router?
Yes, you can. While most consumer routers default to the 192.168.0.0/16 range out of the box, you can log into your router's admin panel and change the LAN IP configuration to use a 172.16.x.x subnet if you prefer.
Why are 172 addresses called non-routable?
They are non-routable on the public internet because core routers are programmed to ignore private IP ranges. This design preserves the limited pool of public IPv4 addresses and prevents external actors from directly scanning or attacking internal home and corporate devices.
How many subnets can I create from the 172.16.0.0/12 block?
It depends entirely on the subnet mask you choose. If you break the /12 block down into standard /24 subnets, you can create up to 4,096 distinct networks, each supporting 254 hosts.
Do IPv6 networks use 172 address blocks?
No. IPv6 uses a completely different addressing architecture and relies on Unique Local Addresses (ULAs) starting with the prefix fc00::/7 for private internal communications instead of IPv4 private blocks.
