Glossary

IP address

An IP address identifies the network destination of communication. On its own, however, it says nothing about which application is running there, who is using it or whether the connection is secure.

Short definition

The numerical address of a network interface, not a service name or a person's identity.

Internet Protocol uses addresses so that routers can deliver data between a source and destination. IPv4 writes an address as four decimal numbers, such as 192.0.2.42; IPv6 uses a longer hexadecimal notation, such as 2001:db8::42. The examples here belong to ranges reserved for documentation and are not real production destinations.

A domain name gives a service a human-readable name, and DNS commonly resolves it to an IP address. After resolution, the client connects to a specific address and port; a reverse proxy can serve multiple websites at the same address. An IP address is therefore not a substitute for a URL, network port, certificate or server-side authentication.

The problem it solves

It enables network communication to be routed to the correct interface

When loading a website, calling an API or connecting services, the network needs to know where to deliver the packets.

DNS returns one or more IPv4 and IPv6 addresses for a website or API hostname
routers forward packets between a private network, an internet service provider and the public internet
a reverse proxy can accept public traffic on a public address and forward it to internal applications
containers and virtual machines use their own network interfaces and addresses according to the environment architecture
network rules and monitoring treat an address as technical data, not as a complete user identity

Practical example

A public entry point and an internal application

A user opens api.example.cz. DNS may return the documentation address 203.0.113.20 for a public reverse proxy. The proxy accepts the HTTPS request and forwards it to the application at a private address such as 10.20.0.15. The database can reside on another private network with no publicly exposed entry point.

A single public address therefore does not necessarily represent one machine or one application. The specific website may only be selected from the TLS name and HTTP Host header, while the internal network may use NAT, a firewall and separate routing.

Network connection flow

Klient
  │ DNS: api.example.cz → 203.0.113.20
  ▼
Veřejná reverse proxy :443
  │ interní síť
  ▼
Aplikace 10.20.0.15:8080
  │
  ▼
PostgreSQL 10.20.1.25:5432

How it works

From a hostname to a connection at an IP address and port

This simplified flow shows that addressing, transport, TLS and the application are separate layers.

The client obtains a network destination A URL usually contains a hostname. A resolver uses DNS to look up the corresponding A record for IPv4 or AAAA record for IPv6.
An address and transport are selected The operating system chooses a suitable network path and typically creates a TCP connection for HTTP. IP delivers packets, while TCP and UDP have their own rules.
The port selects the service The destination port distinguishes the service at the same IP address, such as HTTPS on port 443. The client uses its own temporary source port.
The service handles the connection A web server or reverse proxy can terminate TLS and select the application based on the hostname and path. The IP address itself does not make this selection.
The response travels back Packets return across the network to the source address and port. NAT may map internal and public addresses at the network boundary without the application seeing them directly.

Important related concepts

An address has a scope, purpose and network context.

The same notation may be technically valid, but its reachability and meaning depend on routing and the rules of the specific network.

IPv4 and IPv6

IPv4 uses 32 bits and its public address space is limited. IPv6 uses 128 bits and a different notation. Applications and infrastructure often need to support both versions because DNS can return both A and AAAA records.

Public and private addresses

A publicly routable address may be reachable from the internet depending on the firewall and service. Private ranges such as 10.0.0.0/8 are not globally routable and can be reused in different internal networks.

Loopback and the local interface

Loopback is used for communication within the same device, such as 127.0.0.1 for IPv4 or ::1 for IPv6. It is not a public destination for other computers.

Static and dynamic addresses

A static address changes only in a controlled way, while a provider or internal network can assign a dynamic address for a limited time. A public service therefore usually uses a domain rather than a link to its current address.

NAT and network prefix

A prefix identifies the network part of an address. NAT can translate between internal and public addresses, but it neither grants application permissions nor encrypts traffic.

Benefits and limitations

Numerical addressing is fundamental to network traffic, not a security decision.

Benefits

routers can deliver traffic between independent networks
one infrastructure environment can contain both public and separate internal addresses
IPv6 expands the address space and enables global addressing without the same reliance on NAT
DNS allows infrastructure addresses to change without users changing their URLs

Limitations and common mistakes

one public IP address can represent many users or services
one device can have multiple addresses and network interfaces
a private address is not directly reachable from the internet without additional routing or a proxy
an IP address allowlist is only a supplementary technical control, not general authentication
an X-Forwarded-For header cannot be trusted unless it was set by a known proxy

Practical boundaries

Separate the public entry point from internal services and avoid inferring too much from an address.

Only an entry point that genuinely needs to be public should be exposed, typically a reverse proxy serving HTTPS. Databases, Redis, administration interfaces and internal workers can use only a private address or a Unix socket. Hiding a service at a private address, however, does not replace proper authentication, updates and access rules within the network.

An IP address can reasonably be used for operational diagnostics, restricting a known integration network or protective rate limits. It is not suitable as a long-term user identity: devices behind NAT share an address, and a legitimate client may change it. Access to an order or administration interface must therefore be decided from a verified identity and server-side permissions.

What to consider

Document, segment and verify network addresses along the real traffic path.

During an incident, it must be possible to distinguish the public endpoint, proxy, application and internal data service.

use address ranges reserved for documentation instead of arbitrary public IP addresses in examples
publish both A and AAAA records in DNS only when the service genuinely works over both IPv4 and IPv6
expose the fewest possible ports publicly and keep database services outside the internet-facing entry point
configure trusted proxy addresses behind a proxy and prevent clients from spoofing forwarding headers
monitor availability from both outside and inside the network, because a DNS answer alone does not prove the application is working
do not base sensitive decisions solely on an IP address allowlist without additional authentication and auditing

Common questions

What an IP address does and does not mean

Is an IP address the same as a domain?

No. A domain is a name, while an IP address is a network destination. DNS can connect them, but one domain can have multiple addresses and one address can serve multiple domains.

Is a private IP address secure by itself?

It limits direct global reachability, but does not provide complete protection. The service may be available from the internal network, through a VPN, or through a misconfigured proxy and still needs its own security.

Can I identify a particular user from an IP address?

Usually not reliably. Users behind NAT can share an address, addresses can be assigned dynamically, and proxies may sit between the client and application.

Why do examples use 192.0.2.x or 2001:db8::?

These ranges are reserved for documentation, so the example does not point to an arbitrary real public system.

How I design operational boundaries

I separate the public network, proxy and internal services according to their actual responsibilities.

When designing backends and APIs, I address availability, secure entry points, network boundaries and traceable problems across the infrastructure.

How I approach application architecture Discuss your project without obligation

Official resource: IANA – IPv4 Special-Purpose Address Space