What Is My IP Address: Public, Private and CGNAT

Quick Answer

Whats my ip, and show my ip, both mean the public IP address this connection presents. Find my public IP here as IPv4 and, when the path has it, IPv6. They are two families, not two writings of the same number. Copy my ipv4 for v4-only forms and allowlists. Copy my ipv6 when the peer is v6-first. Your browser asks an IP echo for the number. ToyTools never sees the reply.

How a Public IP Lookup Works

A static page cannot know your public IP address by itself. The address is assigned on the path out, by a router, a carrier NAT, or a VPN. The only way to read it is to ask a host on the other side what it saw. This page does that from your browser, toward ipify.org, and prints the reply. Nothing is stored here, and ToyTools is not in the middle of the request. Therefore a blocker that stops ipify will make the lookup fail. A VPN changes the number because the echo sees the egress, not your living room.

Examples

A public IPv4. For example, 203.0.113.10 is a public IP address. Paste that dotted string into a security group that asks for IPv4.

Dual stack. For example, the same session can also show 2001:db8::1. That is my ipv6, not a rewriting of my ipv4. An allowlist of one will not match the other.

CGNAT. For example, 100.64.1.20 sits in 100.64.0.0/10. Treat it as shared, not as a public IP versus CGNAT mix-up you can whitelist.

IPv4 and IPv6 on the Same Path

The difference between IPv4 and IPv6 is the address family, not the spelling. IPv4 versus IPv6 on the same path is dual-stack: both are true at once. An IPv4 allowlist will not match an IPv6 packet, and a v4-only form will reject a v6 address even when both are correct for this connection. Try the other family before assuming the lookup failed. A v6-only path has no IPv4 to copy, which is a fact rather than a bug.

When the Address Is CGNAT

100.64.0.0/10 is shared address space for carrier-grade NAT, RFC 6598. Public IP versus CGNAT is the reachability test: a 100.64 address is not globally reachable. Opening a port on it, or whitelisting it on a cloud host, will not match traffic from the public internet. The same is true of RFC 1918 private ranges (10/8, 172.16/12, 192.168/16) if an echo ever returned one. That usually means the lookup saw a local or VPN-internal address rather than the public egress.

Common Mistakes