I'd like to understand what anti-packet-spoofing technology exists (or should exist) to verify an inbound packet. Maybe this is as simple as a Cisco ACL, Firewall Rule, implemented at the network boundary; however I think the issue might be a little more involved.
Generally, we would start with source IP blocking with these trains of thought:
- Drop IP ranges that are not in use (per interface)
- Drop IP ranges that are in-use, however should not appear as a sender on that interface
For example, your public interface is likely configured to drop all source addresses starting with 10.x. You might also route a 192.x network with a 172.x network. Since you control each address space in its entirety, you can control what spoofing crosses the router's edge.
But there is a problem with blocking traffic originating from the Internet.
Inbound traffic from your ISP may not have rules applied to the source address. It seems that IP spoofing is permitted out of ISP laziness & cost savings efforts, or there could be a legitimate technical reason (in order to enable some odd IP mobility feature). However I don't believe that IP spoofing is a relevant technology for vast majority of the users of the Internet.
If IP-Spoofing is indeed a "feature" of the internet, then I think the technology should be depreciated and that rare software reconfigured to use a higher level protocol. (please discuss why IP Spoofing is needed at this link)
How can a company with an internet connection reduce exposure to IP Spoofing? How would it be implemented?
What alternatives should exist, that don't?
The second part of my question is a coming from an idealistic "greenfield" hope I have where IP spoofing was crippled or blocked across the internet. I think that a reduction in IP Spoofing will also significantly reduce one's exposure to numerous types of attacks (DDOS, UDP/DNS hacks, etc). Perhaps it's leveraging real time routing tables, a subscription based service, or some other technology.