← All articles

How Many External IP Addresses Does Your Small Business Have? A Plain-English Way to Find Out

By Front Range Cybersecurity ·

If you have looked at an external vulnerability assessment, you have probably run into the question: how many external IP addresses do you have? Most small business owners have never been asked that. Your website works, your email arrives, and the person who set up the office internet moved on years ago.

The question matters for two reasons. It decides what an outside assessment covers, and it is also a good way to see your business the way the internet does. This guide explains what an external IP address is, where to find yours, and which items people forget.

It is general information, not legal advice or a guarantee of any outcome.

What is an external IP address?

An IP address is the number a device uses to be found on a network. An external (or public) IP address is one that can be reached from the internet. The opposite is a private address, which only works inside your own network.

The standard that sets aside private address space is RFC 1918. It reserves three blocks for private use: addresses starting with 10., addresses from 172.16. through 172.31., and addresses starting with 192.168.. The RFC says that an organization that asks for addresses for its external connectivity "will never be assigned addresses from the blocks defined above." So if an address on your laptop or printer begins with one of those, it is a private address, and it is not what outsiders see.

Your office almost certainly has at least one external address. It is usually the one your internet provider gives your router or firewall. Everything inside the office shares it when going out to the internet. Anything you have deliberately made reachable from outside, such as a remote-access login or a camera viewer, comes in through that same door or through another public address.

NIST defines an attack surface as "the set of points on the boundary of a system, a system component, or an environment where an attacker can try to enter, cause an effect on, or extract data from" it. Your external IP addresses, and what is listening on them, are the outer edge of that boundary.

Why the number matters

An external vulnerability assessment looks at your internet-facing systems from the outside, the way an unfamiliar visitor would. The scope is the list of external IP addresses and the services on them.

An accurate count matters: if you undercount, something that faces the internet goes unchecked.

Where to look: nine places external IPs hide

You do not need special software to build a first list. Work through these in order and write down every address you find.

1. Your internet service bill or account

Your internet provider's paperwork often shows whether you have one dynamic address, one static address, or a block of several. A static block is the clearest sign of more than one external IP. If you do not know which you have, ask the provider.

2. Your router or firewall's status page

Log in to the device at the edge of your office network. Its status or WAN page normally shows the public address (or addresses) it has been given. Look for a second address or an "alias." That is common on older setups.

3. A quick check from inside the office

Open any "what is my IP address" page from a computer on your office network. It shows the address the internet sees when you go out. Do this at each location you operate. A second office or a home-office worker with a business connection adds another address.

4. Your port-forwarding and remote-access rules

Open the firewall's rules for anything that lets traffic in from the internet: port forwards, remote-access VPN, and remote desktop. Each rule is a deliberate hole through the boundary. Write down what it points to and who still uses it. It is common to find rules for a vendor visit or a project that ended long ago.

5. Your DNS records

Your domain's DNS records say where your name points. Look at the web address records, the mail records, and any "subdomain" entries like portal, vpn, remote, or mail. Each can point to a public address. Your domain registrar or DNS host has a page that lists them. Several names can point to the same IP address, so what you are counting is the unique addresses, not the number of names.

6. Public certificate records

When a public certificate authority issues a website certificate, the certificate is normally recorded in public logs. That system is called Certificate Transparency. The original specification, RFC 6962, describes the logs as "publicly auditable, append-only, untrusted logs of all issued certificates" and says that those concerned about misissue can monitor them to "check whether domains they are responsible for have had certificates issued that they did not expect." The RFC Editor page now marks RFC 6962 as obsolete, but the idea it describes is the one the system still rests on. For you, the practical point is that these logs can reveal hostnames you forgot you had, and a search of the public logs for your domain name often turns up a test site or an old login page.

7. Cloud and hosting accounts

Websites, booking tools, and file-sharing apps may live on a hosting or cloud account. Check what each account shows for public addresses. Some providers give your server its own address, and others put many customers behind shared ones. If your site sits on a provider's shared infrastructure, the provider's address is not yours to authorize for testing, and you will want to ask the provider about its rules.

8. Devices someone plugged in

Cameras, door controllers, network storage, printers, and building systems sometimes get set up to be reachable from outside "just for now." The setup is usually a port forward from item 4. Ask whoever installed them.

9. The people who set things up

Ask your office manager, your IT provider or contractor, and your web developer: "What have you made reachable from the internet?" People remember things that no console shows.

What does not count

Not everything you own is an external IP address:

  • Private addresses, as above. Laptops, phones, and printers usually have them.
  • Software-as-a-service tools you only log in to, such as hosted email or accounting. The provider runs them, and you cannot authorize testing of someone else's platform.
  • Systems you cannot authorize. You can only agree to testing of systems you own or control. When in doubt, note it on your list and ask the owner.

What to do about the surprises

Once you have a list, look at it with three questions: Do we still need this? Who owns it? Does it need to face the whole internet?

CISA's guidance on edge devices says that devices "such as routers, firewalls and virtual private network gateways, are located at network boundaries and accessible from the public internet" and that they "are prime targets for malicious cyber actors." Its recommendations for owners include to "create and maintain an asset inventory that captures all edge devices and their EOS dates" (end-of-support dates), and to "disable risky and unnecessary services," naming remote desktop among them, and to close the associated ports. If a service has a business purpose, CISA says to apply compensating controls such as a deny-by-default allowlist.

CISA's Binding Operational Directive 23-02, which binds federal agencies and is useful as a reference point for everyone else, makes a related point. It says that "most device management interfaces are designed to be accessed from dedicated physical interfaces and/or management networks and are not meant to be accessible directly from the public internet." If the login page for your firewall or camera system answers to anyone on the internet, that is worth a conversation with whoever manages it.

Then there is software that is out of date. CISA maintains a Known Exploited Vulnerabilities (KEV) catalog, which it calls "the authoritative source of vulnerabilities that have been exploited in the wild," and it says organizations "should use the KEV catalog as an input to their vulnerability management prioritization framework." If one of your internet-facing products appears there, move it to the top of your fix list.

A simple rule: remove what you do not need, restrict what you do need to the people who use it, and keep the rest updated.

Keep the fixes from coming back

Fixing a list once does not keep it fixed. Software releases updates, people add things, and last year's clean list drifts. Two habits help: re-check your inventory on a schedule, and keep your computers patched.

Using the count

With your list in hand, share it with whoever manages your network, or with any outside provider, along with:

  1. The list of external IP addresses, and where each one came from.
  2. What each one is for (office connection, website, remote access, camera).
  3. Who owns or controls it. If a provider does, note that.
  4. Anything you are unsure about. It is fine to put "I don't know what this is" on the list.

An external assessment is a point-in-time view of what is reachable and what has known weaknesses. It does not test your internal network, it does not attempt to break in and chain weaknesses together, and it does not make you compliant with any law or standard. It gives you a prioritized list so you know where to start.

A free resource

For a free list of security basics you can check yourself, see the SMB Security Checklist.

Sources

All pages were fetched and read on November 1, 2026 (America/Denver).

This article is general information, not legal or compliance advice. A vulnerability assessment supports, but does not certify or guarantee, compliance with any law or standard or protect against any particular attack. Only test systems you own or have written authorization to test.