Public vs Private IP Addresses: Which One a VPN Changes

Almost every device sits behind two addresses at once: a private one that only exists inside your own network, and a public one that the rest of the internet sees. A VPN changes the public one. The private address on your local network keeps working exactly as it did, because your traffic still has to leave your house through the same router.

Confusing the two is the single most common reason people think a VPN is broken when it is working fine, or think it is working when something is leaking.

Private addresses are local and reusable

Private address ranges are set aside for use inside networks, and they are deliberately not routable on the public internet. The familiar ones start with 192.168., 10., or fall in the 172.16.–172.31. range. Your laptop, your phone, your printer, and your smart speaker each get one from the router’s DHCP server when they join the Wi-Fi.

Because these addresses are never seen outside your network, the same ones get reused everywhere. Millions of homes have a device at 192.168.1.5. That is not a collision, because those addresses only have meaning within their own network. It is also why a private address tells an outsider essentially nothing about you — there is no global registry mapping it back to a person.

Inside your network, though, the private address is how devices find each other: casting to a TV, reaching a network drive, or opening a router’s admin page all depend on it.

The public address is the one the internet answers to

Your router holds a single public address, assigned by your internet provider, and every device behind it shares that address when it talks to the outside world. The router keeps a translation table so replies find their way back to the right device — that is network address translation, or NAT.

So when a website says it can see your IP address, it means your router’s public address. It does not see the private address of the specific laptop that made the request, and it cannot tell how many devices are behind the router. That is a natural, longstanding form of blending in that has nothing to do with a VPN.

The public address is also the one that carries information about you: which provider issued it, roughly which region that provider serves it in, and — if the address stays stable — a way to recognise repeat visits from the same connection.

What a VPN actually substitutes

A VPN builds an encrypted tunnel from your device to a VPN server, and the server makes requests on your behalf using its own public address. Sites see the VPN server’s address instead of your router’s. Your provider still sees that you connected to the VPN server, but not what you asked for beyond it.

Two things do not change:

• Your private address stays the same. Your device is still 192.168.x.x on your own Wi-Fi. Local devices still see each other, unless the VPN app is configured to block local network traffic.
• Your router’s public address stays the same. It is still assigned by your provider and still visible to the VPN server, which has to know where to send replies. A VPN moves the address that third parties see; it does not make your provider forget you.

If you want to see the substitution happen, checking your VPN IP address before and after connecting is the direct way to confirm it.

Where the two get tangled

The most common misreads all come from expecting one address to behave like the other.

Local devices vanish after connecting. Some VPN apps have a “block local network access” or “LAN access” toggle. Turning it on stops your device from reaching things on its own private network, which is why casting or printing suddenly fails. That is a policy setting, not a routing failure.

A leak shows a familiar-looking number. A leak test that reports your provider’s public address means traffic escaped the tunnel. A page that reports a 192.168. address is describing something else entirely — usually a local address a browser API surfaced, which is a different problem with a different fix. Both are worth understanding, and checking for leaks separates them.

A second device behaves differently. If one device is on the VPN and another is not, they present different public addresses despite sharing the same Wi-Fi. That is expected: a VPN app tunnels one device’s traffic, not the whole network. Running the VPN on the router is what changes the public address for everything behind it.

A third address you may not have noticed

When a VPN connects, your device gains an extra private address on a virtual network interface — the tunnel’s own address, assigned by the VPN server. It is private, it belongs to the provider’s internal network rather than yours, and it is what makes the tunnel look like an ordinary network adapter to the operating system.

So a connected laptop can hold three addresses at once: its private LAN address, the tunnel’s private address, and — through the server — the public address the internet sees. None of them contradict each other; they describe three different scopes.

How to tell which one you are looking at

Scope is readable from the address itself. If it starts with 192.168., 10., or sits in 172.16.–172.31., it is private and only meaningful inside some network. Anything else you see reported for your own connection is public, and worth knowing whether it belongs to your provider or your VPN.

Two practical habits follow:

• When troubleshooting reachability inside your home — casting, file shares, printers — work with private addresses and ignore the VPN except as a possible blocker.
• When troubleshooting what the internet sees — geolocation surprises, blocks, leak tests — work with the public address and ignore the private one entirely.

Keeping those two questions separate turns most VPN mysteries into ordinary, answerable problems.