172.16.0.0/12 — the middle private block
172.16.0.0/12 is the middle of the three RFC 1918 private ranges: 1,048,576 addresses spanning 172.16.0.0 through 172.31.255.255. The /12 boundary is the part everyone gets wrong — only second-octet values 16 through 31 are private. 172.32.0.1 is a perfectly ordinary public address, and treating it as private will ruin your afternoon.
It holds a sixteenth of what 10.0.0.0/8 offers and sixteen times what 192.168.0.0/16 does. That in-between sizing made it the historical pick for medium-sized organizations — and, famously, for Docker's default networks.
| Network address | 172.16.0.0 |
| Subnet mask | 255.240.0.0 |
| Wildcard mask | 0.15.255.255 |
| Broadcast address | 172.31.255.255 |
| First usable | 172.16.0.1 |
| Last usable | 172.31.255.254 |
| Total addresses | 1,048,576 |
| Usable hosts | 1,048,574 |
The /12 boundary that trips everyone up
A /12 fixes the first twelve bits. The first octet (172) sits fully inside the network portion; of the second octet only the top four bits are fixed, and 172's next nibble is 0001 — so the second octet ranges over 0001xxxx, i.e. 16 to 31. Everything from 172.0.x.x to 172.15.x.x, and from 172.32.x.x upward, is public space belonging to someone else.
This produces the classic firewall bug: an admin writes "allow 172.x" as shorthand for private and accidentally whitelists hundreds of public /16s. Write the range as 172.16.0.0/12, or as the explicit span 172.16.0.0–172.31.255.255 — never as a wildcard octet.
Who uses it and why
Enterprises that expect to interconnect — mergers, partner VPNs, extranets — often standardize on 172.16–172.31 precisely because it is the least crowded RFC 1918 choice. Homes use 192.168.x and clouds default to 10.x, so numbering your LAN out of this block dramatically lowers the odds of overlapping with a network you will someday need to reach.
Docker is the other big claimant: the daemon's default bridge lives at 172.17.0.0/16, and user-defined networks allocate 172.18.0.0/16 and upward. That decision single-handedly created the "Docker stole my VPN subnet" genre of outage.
CIDR Calculator
Run the math on 172.16.0.0/12 — or any other block
Frequently asked questions
Is 172.16.0.0 a private IP address?
Yes — it is the network address of the 172.16.0.0/12 private block. The private span runs from 172.16.0.0 to 172.31.255.255; anything outside it, like 172.15.x.x or 172.32.x.x, is public.
Is 172.32.0.0 a private range?
No. The /12 covers second-octet values 16 through 31 only. 172.32.0.0 and beyond are public address space and must not be filtered or treated as RFC 1918.
How many addresses are in 172.16.0.0/12?
1,048,576 (2^20): sixteen contiguous /16 blocks, from 172.16.0.0 through 172.31.255.255.
Why does Docker use 172.17.x.x?
Docker's default bridge network is 172.17.0.0/16, carved from this private block; user-defined networks take 172.18.0.0/16 and up. See the 172.17.0.0/16 page for the collision story.