Search code examples
network-programmingip-addressnetwork-protocols

Can a website see my internal IP Address?


I know that websites can access my IP address, but is this IP address the internal (my computer's IP) or are they simply seeing the external (my Internet network's IP address)?


Solution

  • in short, any website you visit will only be able to view your external IP address (what your ISP provides you with), while your internal IP address (192.168.1.x or 10.0.0.x) will not be visible to the outside world. This is due to NAT (Network Address Translation) which allows us to 'cheat' the IP protocol and have way more devices online than there are actual IP addresses.

    The only exception to this would be if your machine is plugged directly into the wall/modem. If there is no router inbetween your machine and the connection to the ISP, then there will be no NAT and your machine will be assigned your external IP address.

    As per your comment in @nico answer, do you know of any reliable sources that state they can't access my Internal IP?, it is inherent to the NAT protocol. By design, NAT makes it impossible for outside sources to know your internal IP address (baring any malicious code) because the router handles the translation from internal to external IP and vice versa. The router never publishes this information, it is all done internally and thus hidden from outside sources. Id suggest to read more about NAT if you still have questions about how exactly the internal IP is protected.

    NOTE: Your internal IP address is not static and will change with some level of frequency depending on your router's configuration. This is due to DHCP which most routers are configured to run. On the other hand your external IP address will rarely, if ever, change, depending on your ISP.

    In response to your question about multiple machines on the same network, here is how it would work. Each machine would receive a unique internal IP address from the router. When sending out requests, the router will 're-assign' the internal IP's to external IP's, keeping track of the what translations were made so that it can correctly identify where responses should go. Because of this, to a remote website, it will look like all of the traffic from a network is coming from 'the same machine', i.e. one IP address, your external IP address. Because of the NAT, the remote website has no way of even knowing that internal IP addresses exist. It just sees the external IP and sends the response right back, the router handles which internal IP should receive the response. This is why websites should always use cookies when determining unique users, because if they just relied on the IP address of the request, it would think that every request from a network (regardless of which machine) was being made from the same machine.