Private Networks and the 172.x Zone
Most people who deal with networks on a regular basis hit the same wall within their first week: they look at an IP address like 172.18.4.22 and have no idea whether it's routable, reserved, or something they should be worried about seeing on a public interface. RFC 1918 defined three private ranges back in 1996, and the 172.16 through 172.31 block is the middle one. It's smaller than you might think at first glance, which is exactly why people confuse it with the other two. The 172.16.0.0/12 range holds exactly 1,048,576 individual addresses. That's 16 contiguous /16 subnets, starting at 172.16.0.0 and ending at 172.31.255.255. Everything from 172.0.0.0 to 172.15.0.0 and from 172.32.0.0 upward is publicly routable space unless some other reservation applies. The reason it doesn't line up on a clean decimal boundary is historical: the original classful system carved things up differently, and when CIDR arrived the IANA just grabbed a 16-subnet chunk that happened to fit neatly into the class B portion of the address map. You can't express it as a /16, but it is a single contiguous block. I ran into this exact problem a few years ago when I was troubleshooting a VPN tunnel that kept dropping between two office sites. One side was advertising 172.16.0.0/16 and the other was using 172.16.0.0/20 for its internal LAN. The overlap looked fine on paper because both started with 172.16, but the /20 was eating into the /16's address space and the route summarization was silently dropping traffic. I spent about forty-five minutes tracing the issue by comparing the routing tables on both routers and then realized I'd been looking at the wrong subnet mask the whole time. The fix was changing the site B advertisement to 172.20.0.0/14 so the blocks stopped overlapping entirely. If you're working with multiple private ranges on a single network, make sure they don't share any address space. Check the mask, not just the first octet.
How to tell if an address falls in the 172 private range: Take the second octet of the IP address. If it's between 16 and 31 inclusive, you're in the RFC 1918 space. 172.16.0.1 through 172.31.255.254 are all valid private host addresses in this range. Anything outside that second-octet window is public or belongs to a different reserved block.
How It Actually Works In Practice
When you assign addresses from this range, you pick a subnet mask and hand out IPs from the usable host pool. The most common setup I see is a /24 on a single VLAN, giving you 254 usable hosts. That's fine for a small department. Larger deployments typically use /20 or /16 boundaries depending on how many devices need to live on the same broadcast domain. The tricky part comes when you mix this range with the other RFC 1918 blocks. The 10.0.0.0/8 space is huge and the 192.168.0.0/16 space is tiny, so organizations tend to allocate 10.x for campus cores, 172.x for campus buildings or specific services, and 192.168.x for guest or IoT networks. This separation isn't mandatory but it prevents accidental overlap when you're merging networks after an acquisition or consolidating data centers. Here's a concrete example I use when I train junior engineers. Say you're given 172.24.0.0 and need five subnets with room for up to 500 hosts each. A /22 gives you 1022 hosts per subnet, which covers your requirement. You'd carve out 172.24.0.0/22, 172.24.4.0/22, 172.24.8.0/22, 172.24.12.0/22, and 172.24.16.0/22. Each one is cleanly separated and you haven't wasted much address space. If you tried to use /23s instead, you'd need ten subnets to get the same host count and you'd burn through your range faster for no real benefit.
Get the Full Details
Common Mistakes That Waste Hours
The biggest issue I see is people treating 172.16.0.0/12 like it starts at 172.16.0.0/16 and forgetting the full extent goes to 172.31.0.0. They'll design a network using 172.16 through 172.20 and then wonder why they can't expand into 172.25 without renumbering. The entire /12 is available to you if you plan for it. Use VLSM from the start and document your allocations. A simple spreadsheet with the range, mask, purpose, and date assigned will save you from guessing later. Another mistake is assuming 172 addresses are inherently safer than public ones. They aren't. Any device on the internet that receives traffic destined for 172.18.5.10 from an outside source means your border router is NATing or routing private addresses incorrectly. I've seen this happen when a misconfigured upstream provider sent traffic to a customer's private range because the customer's firewall was set to accept it. The fix involved blocking 172.16.0.0/12 inbound on the perimeter and adding an explicit deny rule on the edge router. There's also the question of documentation standards. Some teams write 172.16.0.0/12 as just "172 space" and leave it at that. When you come back to that documentation six months later after a team member has left, you won't know which /16s are actually in use and which are reserved for future expansion. Write it out fully: 172.16.0.0 through 172.31.255.255, divided into /16 blocks with a label for each.
What This Approach Doesn't Solve
Private addressing doesn't give you authentication, encryption, or visibility into who's using what. If you need to track device identity or enforce zero-trust policies, you'll need additional tooling regardless of which IP range you choose. The 172.x block is just an addressing scheme. It doesn't replace DNS management, DHCP logging, or network access control lists. Some environments avoid the 172 range entirely because legacy equipment from the early 2000s had bugs with certain subnet calculations in this zone. I haven't encountered this in production for years, but if you're maintaining an industrial control system or an older medical device network, check the vendor documentation before assigning 172.x addresses. In those cases, sticking with 10.0.0.0/8 is usually the safer choice. For home users or very small offices, the 172.16.0.0/12 range is overkill. A single /24 from 192.168.1.0 covers everything you need and the simpler addressing makes it easier to troubleshoot when something breaks. Only reach for 172.x when you're managing multiple subnets or expect growth beyond a handful of devices.
