diff --git a/libs/tools.py b/libs/tools.py
index 7a984df..4f98677 100644
--- a/libs/tools.py
+++ b/libs/tools.py
@@ -5,7 +5,7 @@ from bundlewrap.utils.text import bold, red
 from bundlewrap.utils.ui import io
 
 
-def resolve_identifier(repo, identifier, linklocal=False, only_physical=False):
+def resolve_identifier(repo, identifier, linklocal=False, only_physical=False, allow_private=True):
     """
     Try to resolve an identifier (group or node). Return a set of ip
     addresses valid for this identifier.
@@ -62,10 +62,15 @@ def resolve_identifier(repo, identifier, linklocal=False, only_physical=False):
         'ipv6': set(),
     }
 
+    has_public_ips = bool([ip for ip in found_ips if not ip.is_private])
+
     for ip in found_ips:
         if ip.is_link_local and not linklocal:
             continue
 
+        if ip.is_private and not allow_private and has_public_ips:
+            continue
+
         if isinstance(ip, IPv4Address):
             ip_dict['ipv4'].add(ip)
         else: