IPs starting with 192.168 cannot connect to the external network. A picture can distinguish between public and private.

Last week, my cousin was on a business trip and left the remote access control of the Synology at home to me. He sent the NAS address 192.168.0.30 , I typed it in on my home computer and searched around for half a minute, but I couldn’t connect - it wasn’t because of his internet speed, it was because this address simply couldn’t get out of his front door.

Later I told him something in plain language: Your number is the house number within the community, there are hundreds of thousands of them across the country. 192.168.0.30 , the router outside doesn’t know whose door to knock on. I've been thinking about this for a while. I see IP addresses every day. If I were to tell you why, most people would be stuck. Let’s break it down and talk about it in this article.

What exactly is IP?: 32 bits broken into four segments

An IP address is the number assigned to a networked device. The version of IPv4 that is still widely used today has an address of 32 bits. When written, it is divided into four segments of 8 bits each, separated by dots, such as 192.168.31.108 . Each segment can represent 0 to 255. When all four segments are arranged, there are a total of about 4.3 billion numbers.

4.3 billion sounds like a lot, but it cannot support the 8 billion people in the world. Two mobile phones, one computer and one camera per capita are enough. In the 1990s, it was discovered that there were not enough numbers, so IPv6 was introduced - 128 bits, with so many numbers that every grain of sand on the earth could have one. I wrote a separate article before about the IPv6 address that looks like garbled characters starting with 240e. How to read an IPv6 address , this article only talks about old IPv4.

The four-segment numbers can also reveal some clues.: The first few paragraphs are equivalent to "which community", and the following paragraphs are "which household in the community". Specifically, the first few paragraphs count the community and the last few paragraphs count the room number. The subnet mask has the final say. I have written about the mask. 255.255.255.0 What the hell does it matter? , here it is enough to remember the rough impression of "number = community name + room number".

If you want to see the number of your device, you can find it in three places: Type ipconfig on the command line on the computer to see the IPv4 line ； Check the WiFi details page on your mobile phone ； The router's backend has the most complete list of devices, and whoever gets the numbers will see them all on one screen. After reading it, I suggest you take a screenshot and save it. If you look back at which device is having a problem, it’s much faster to find someone who is talking about it rather than unplugging the power one by one.

Public IP and Private IP: House numbers and room numbers in communities around the world

The critical watershed has come. Among the 4.3 billion accounts, a large number are artificially circled and stipulated that they can only be used at home and are invalid when leaving the house - this is a private address. The rules of enclosure are written in the document RFC1918, which consists of three paragraphs.:

Home routers almost always select the 192.168 segment by default, so the backend addresses of your home, my home, and my cousin's home all start with 192.168. There are countless communities with the same room number, why don't they fight? Because once the private account is out of the door, it is just a waste of paper.: When the router on the Internet sees that the destination is an address in these three segments, it just throws the packet away without forwarding it at all. This is also why you pinged your home station at work 192.168.1.108 , is always unreasonable.

How do intranet devices access the Internet? Use the router as a translator. Carrying the mobile phone 192.168.31.108 When this internal room number goes out, the router will first change it to the public IP of your home broadband before sending it out, and the returned packet will be translated back and distributed to the corresponding device. This technology is called NAT. The NAT1/2/3 familiar to gamers refers to the way it works. The NAT type article I wrote how to check and correct. One official account has dozens of private accounts, and 4.3 billion accounts have managed to survive until today.

There is another common misunderstanding, let me put it aside.: Which segment you use at home is not determined by fate. The LAN port of your router will be changed to the same segment you use for your whole family. My AX3000T was set up that year 192.168.31.1 , the whole family is 31.x ； Cousin's Mercury factory default 192.168.0.1 , his family is all 0.x. The public IP outside the door is issued by the operator. It doesn't matter what you say, it may drift back every once in a while - my home telecom number has changed from the number starting with 117.136 to the number starting with 111.72. I need to rely on DDNS to fix it. This is another story.

Those strange addresses that look alike, each has its own meaning.

In addition to public and private ownership, there are also several special sections. We encounter them every day when troubleshooting. If we recognize them all, we can avoid detours.:

I have stepped on the section 169.254: There was a flashback cat convulsing, and the computer picked up a string of numbers starting with 169.254. The web page could not be opened, but the network card looked normal. 192.168.1.1 Can't open that article I wrote about how to save myself. 0.0.0.0 It looks like Xuanhu, but it’s actually a bag of tricks that says, “If you don’t recognize the others, leave it to me.” The routing table article Expanded when talking about route print.

100.64 I’ll say one more thing about this paragraph. I have two broadbands at home. The main telecom line is a real public network IP, and the secondary line from China Mobile starts with 100.89 - a group of users share a small number of public network outlets. I don’t feel comfortable watching videos on a regular basis, but if I want to go out and even use the NAS at home, I’ll be confused. If you want to know what kind of broadband your home has, you can check it in three steps. How to check public IP That article was written carefully.

Who is issuing the IP and why does the number change?

The IP at home is issued by the router's DHCP, just like the number issued by a property management company, and it is rented - the number may change when the lease expires, the device is reconnected, or the router is restarted. The DHCP article I went through the four steps of issuing numbers. NAS and printers are devices that need to be found. Once the rules change, they will become invalid and must be nailed down.: Either do DHCP static binding on the router, or manually fill in the static IP on the device. Both methods have their own pros and cons. Static IP binding article Compared.

If the number is reissued, there is an IP conflict. Two devices compete for the same room number, and the network is intermittently connected. You don’t need to install tools to check it. Just use arp -a to see if the MAC address behind the same IP has been changed. The ARP article There is a complete process. There is also a rack that both devices think they should use. 192.168.1.1 , optical modem and router fight with IP, who should let whom should be careful, The article that conflicts with IP Wrote the Judgment Method.

IP, MAC, gateway, mask, each of the four roles has its own responsibility.

These concepts are easiest to mix up. Let me compare them with my cousin’s Synology. 192.168.0.30 It's its IP and room number, which can be changed. ； The string starting with 00-11-32 is MAC, the ID card burned into the network card at the factory. The difference between MAC and IP I wrote it alone ； 192.168.0.1 It is the gateway, the communication room of the community, and all the packages leaving the community are handed over to it for change. The gateway article I told you what will happen if you fill in the wrong form ； 255.255.255.0 It is a mask that delineates which numbers are counted as direct calls to the community and which numbers have to be sent to the reception room. By the way, the reason why Synology couldn't connect to the Synology last time was because of the Win11 signature on his computer. It’s not the same disease as this time , the number was correct that time, but the rules of shaking hands have changed.

In one word, everyone belongs to you: IP controls "what number do you have?", MAC controls "which station you are on", gateway controls "who you are looking for when you go out", and mask controls "whether you are a neighbor". The four of them are doing their own thing, and if any one of them is missing, they won’t be able to get on the Internet.

Back to my cousin’s NAS: How do you get in from the outside?

After figuring out public and private, the idea of ​​​​remote access is smooth.: If the private account at home cannot get out, there are two options - either let the bag outside the door come in, or let the equipment at home take the initiative to come out to pick you up.

The premise of the former is that your own broadband really has a public network IP. If you want one that starts with 100.64, give up first and call 10000 to ask if it can be given. With the public IP, do port forwarding on the router and direct a high-level port on the public network to the private account of the NAS. Port forwarding and DMZ article There are complete steps. The latter has more choices: Synology's QuickConnect, frp relay, or setting up a VPN on the router to connect yourself home, the security and freedom are better. VPN back home article I ran three routes. My cousin's broadband happens to have a real public network. I use the public network IP and port forwarding, and it works all the time.

To wrap things up, give a judgment sequence.:

To put it bluntly, IP addresses are a numbering system that distinguishes between "valid when going out" and "valid at home only." This provides a direction for most network problems. First check which segment the number belongs to, then check who issued the number, and finally check whether the number has been collided with someone else - I have used this sequence for several years, and it is much more effective than blindly restarting.