Private IP Checker API: The Complete Guide to IP Classification

Need to identify private, reserved, or special IP addresses? This guide covers everything you need to know about IP classification via API, including RFC 1918 ranges, special addresses, and implementation examples.

What are Private IP Addresses?

Private IP addresses are reserved for internal network use and are not routable on the public internet. Defined by RFC 1918, they allow organizations to use the same address ranges internally without coordination.

The three private IPv4 ranges are: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.

IP Classifications

Beyond private IPs, several special address types exist:

Private (RFC 1918)

10.x.x.x, 172.16-31.x.x, 192.168.x.x - Internal network addresses.

Loopback

127.0.0.0/8 - Refers to the local machine. 127.0.0.1 is "localhost".

Link-Local

169.254.0.0/16 - Auto-configured when DHCP fails. Also called APIPA.

Reserved/Special

0.0.0.0/8, 240.0.0.0/4, broadcast (255.255.255.255) - Various special purposes.

Using the Private IP Checker API

TinyFn provides a simple endpoint to classify IP addresses:

GET https://api.tinyfn.io/v1/network/check-private?ip=192.168.1.100
Headers: X-API-Key: your-api-key

{
  "ip": "192.168.1.100",
  "isPrivate": true,
  "isPublic": false,
  "isLoopback": false,
  "isLinkLocal": false,
  "isReserved": false,
  "classification": "private",
  "rfc": "RFC 1918",
  "range": "192.168.0.0/16"
}

Parameters

Code Examples

JavaScript / Node.js

// Check if IP is private
const response = await fetch(
  'https://api.tinyfn.io/v1/network/check-private?ip=192.168.1.100',
  { headers: { 'X-API-Key': 'your-api-key' } }
);
const { isPrivate, classification } = await response.json();
console.log(`Is private: ${isPrivate}`);        // true
console.log(`Classification: ${classification}`); // private

// Check public IP
const publicResponse = await fetch(
  'https://api.tinyfn.io/v1/network/check-private?ip=8.8.8.8',
  { headers: { 'X-API-Key': 'your-api-key' } }
);
const publicData = await publicResponse.json();
console.log(`Is public: ${publicData.isPublic}`); // true

// Validate URL doesn't target internal services (SSRF prevention)
async function isSafeUrl(url) {
  const hostname = new URL(url).hostname;
  const response = await fetch(
    `https://api.tinyfn.io/v1/network/check-private?ip=${hostname}`,
    { headers: { 'X-API-Key': 'your-api-key' } }
  );
  const { isPublic } = await response.json();
  return isPublic;
}

Python

import requests

# Check if IP is private
response = requests.get(
    'https://api.tinyfn.io/v1/network/check-private',
    params={'ip': '10.0.0.1'},
    headers={'X-API-Key': 'your-api-key'}
)
data = response.json()
print(f"Is private: {data['isPrivate']}")  # True
print(f"Range: {data['range']}")           # 10.0.0.0/8

# Check loopback
response = requests.get(
    'https://api.tinyfn.io/v1/network/check-private',
    params={'ip': '127.0.0.1'},
    headers={'X-API-Key': 'your-api-key'}
)
loopback = response.json()
print(f"Is loopback: {loopback['isLoopback']}")  # True

cURL

# Check private IP
curl "https://api.tinyfn.io/v1/network/check-private?ip=192.168.1.100" \
  -H "X-API-Key: your-api-key"

# Check public IP
curl "https://api.tinyfn.io/v1/network/check-private?ip=8.8.8.8" \
  -H "X-API-Key: your-api-key"

Common Use Cases

• SSRF Prevention: Block requests to internal/private IPs
• Input Validation: Reject private IPs in public-facing forms
• Log Analysis: Classify IPs in access logs
• Network Auditing: Identify internal vs external traffic
• Webhook Validation: Ensure webhooks come from public IPs

Best Practices

1. Always validate user input: Never trust user-provided IPs or URLs
2. Block all special ranges: Not just RFC 1918, but loopback, link-local, etc.
3. Handle IPv6: Private IPv6 ranges exist too (fc00::/7)
4. Consider DNS rebinding: Re-check after DNS resolution