Can a website see my internal IP Address?

Question

I know that websites can access my IP address, but is this IP address the internal (my computer's IP) or are they simply seeing the external (my Internet network's IP address)?

Solution 1

in short, any website you visit will only be able to view your external IP address (what your ISP provides you with), while your internal IP address (192.168.1.x or 10.0.0.x) will not be visible to the outside world. This is due to NAT (Network Address Translation) which allows us to 'cheat' the IP protocol and have way more devices online than there are actual IP addresses.

The only exception to this would be if your machine is plugged directly into the wall/modem. If there is no router inbetween your machine and the connection to the ISP, then there will be no NAT and your machine will be assigned your external IP address.

As per your comment in @nico answer, do you know of any reliable sources that state they can't access my Internal IP?, it is inherent to the NAT protocol. By design, NAT makes it impossible for outside sources to know your internal IP address (baring any malicious code) because the router handles the translation from internal to external IP and vice versa. The router never publishes this information, it is all done internally and thus hidden from outside sources. Id suggest to read more about NAT if you still have questions about how exactly the internal IP is protected.

NOTE: Your internal IP address is not static and will change with some level of frequency depending on your router's configuration. This is due to DHCP which most routers are configured to run. On the other hand your external IP address will rarely, if ever, change, depending on your ISP.

In response to your question about multiple machines on the same network, here is how it would work. Each machine would receive a unique internal IP address from the router. When sending out requests, the router will 're-assign' the internal IP's to external IP's, keeping track of the what translations were made so that it can correctly identify where responses should go. Because of this, to a remote website, it will look like all of the traffic from a network is coming from 'the same machine', i.e. one IP address, your external IP address. Because of the NAT, the remote website has no way of even knowing that internal IP addresses exist. It just sees the external IP and sends the response right back, the router handles which internal IP should receive the response. This is why websites should always use cookies when determining unique users, because if they just relied on the IP address of the request, it would think that every request from a network (regardless of which machine) was being made from the same machine.

Solution 2

I see this is an old May 2014 post but Michael you are correct to be concerned. WebRTC in your web browser does leak your internal LAN IP address. Using NAT doesn't protect you and neither does using a VPN offer any protection -- because it's your web browser that has the security flaw. I'm using Firefox v61 right now and I confirmed it is leaking my internal IP address (that's how I ended up reading your message here).

Disable WebRTC. Many websites are using WebRTC now to collect/reveal your internal LAN IP address. WebRTC can even be used to scan your internal network. Test if your browser is leaking your ip at https://www.vpninsights.com/webrtc-leak-test

Solution 3

The simple answer is "yes".

Basically every answer here that includes the words "never", "only", or "no" are wrong. @MylesF and @M.Rao and @secretformula got it right.

For proof, simply navigate to this web-page: https://www.whatismyip.com/

If you see your internal IP address it could be because your browser is leaking your internal IP address via WebRTC, as @Myles F points out in the next post with a perfect explanation.

Solution 4

Websites such as whatismyip.com or whoer.net can see your internal (Private) IP address, even if you are behind a router.

Disable JavaScript to "hide" your routing table/private IP

View more solutions

Comments

[Michael Rader]

So if I change my Internet connection by connecting someplace else, they have no way of knowing if it is the same computer accessing their website?

[Nico]

Exactly, unless they use cookies of some sort but you can easily clear cookies with your browser.

[Michael Rader]

So they can access the internal IP with cookies?

[Nico]

No they can never access your internal IP. But they can use cookies to recognize you even if your IP address is different.

[Michael Rader]

Do you know of any reliable sources that state they can't access my Internal IP? I can't find anything.

[Michael Rader]

Thank you. So if I have two computers on the same network, they aren't given the same IP? The website can still identify that the same computer is being used on their site multiple times?

[Joeytje50]

Gotta love the amount of text on this answer which starts with "in short, ..."

[user3204729]

whatismyip.com I found that a website know my local ip but don't know how it is done.

[William Entriken]

stackoverflow.com/questions/53563293/… -- How can whatismyip.com see my LAN IP address?

[Byte11]

You can check whether your ip is leaking here: ipleak.net. Turn on your VPN and see if it gets your internal ip address. It was able to get mine with NordVPN and firefox v70.