The network layer (layer 3) gets a packet from one machine to another, even when they sit on different networks on opposite sides of the world. Its protocol is IP, the Internet Protocol. You rarely write code at this layer, but it decides which of your machines the internet can reach, which is a security decision you make in every design.
IP: addressing and routing#
IP gives every machine an address and moves packets toward it.
- Every device has an IP address, such as
203.0.113.7(IPv4) or2001:db8::1(IPv6). - Data is split into packets, each carrying a source and destination address.
- Routers live at this layer. Each one reads a packet's destination address and forwards it to the next router that is closer to the destination. No single router knows the whole path.
- IP is best effort: packets can be lost, duplicated or arrive out of order. Fixing that is the transport layer's job (TCP). See Transport Layer Protocols.
Public vs private IPs#
IP addresses come in two kinds, and the difference decides who can reach a machine.
| Public IP | Private IP | |
|---|---|---|
| Reachable from | Anywhere on the internet | Only inside its own network |
| Assigned by | Regional internet registries, through ISPs and cloud providers | You or your cloud network |
| Ranges | Everything not reserved | 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 |
| Analogy | Your street address, which the postal service can find | A room number that only means something inside your building |
Two laptops in different homes can both be 192.168.1.5 without conflict, because private addresses only mean something within their own network. When a private machine talks to the internet, a router performs NAT (network address translation), swapping in a public address on the way out.
In system design: give the load balancer a public IP so users can reach it. Keep app servers and databases on private IPs inside a private network (a VPC in the cloud). The internet can't even attempt to connect to your database directly.
Routing and why location matters#
Internet routers know which blocks of addresses belong to which networks. For example, Apple has historically owned the whole 17.0.0.0/8 block. Routing works on these blocks rather than individual addresses, which keeps routing tables manageable.
This is the basis for techniques that send a user to the nearest server:
- Anycast: the same IP address is announced from many locations, and the network delivers each user's packets to the closest one. Large DNS providers and CDNs use this.
- Geo-aware DNS: the DNS server returns a different IP depending on where the user is.
Both shorten the physical distance a request travels, which is the biggest single factor in network latency. See Regionalization and Latency.
Key takeaways#
- IP moves packets between networks on a best-effort basis. Routers forward them hop by hop.
- Public IPs are reachable from the internet. Private IPs only work inside their own network, and NAT bridges the two.
- Expose only the load balancer publicly. Keep app servers and databases on private IPs.
- Anycast and geo-aware DNS use routing to send users to a nearby server.