Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Quick Security Question if i may.

We have an internal Intranet system which is only accessible from a few internal vlans, our main external firewall blocks all access to the internal webserver – or rather, has no rules to allow access!

Now then, we have 100's of branches out in the UK that sit on a private network, most have VPNS to head office & access our intranet that way, there is however instances where we can’t arrange a vpn (politics, costing, resources etc) & we are considering opening our internal webserver to the internet with strict firewall rules to only allow traffic from the static IP's of the branches in question (let’s call this the whitelist).

Now then, everyone knows that IP spoofing exists, and it's bordering on easy when you're on the same subnet, my question is this, can an IP be spoofed over the internet in a way that would make our internal webserver accessible from IP's not matching the branch whitelist?

To clarify, I know it's possible to spoof an IP over the internet, but I’ve never seen examples of 2 way communication, i.e. the webserver would try sending packets back to the faked IP, not the IP of the person faking the IP (if that makes sense) - so is spoofing really a threat for our scenario?

Cheers.

share|improve this question
add comment

2 Answers 2

up vote 1 down vote accepted

IP spoofing on the Internet relies on misconfiguration of so many routers and firewalls that a packet has to travel all these (all in turn administered by different parties) that the chance it works is 0. Routers commonly filter incoming IP's / outgoing IP's on what they expect to see.

share|improve this answer
    
Thought so, i just wanted to confirm the risk was negligible before suggesting it to management - Cheers –  HeavenCore May 2 '12 at 14:29
    
@jippie is correct, but you do have to make sure that your firewall rules are properly configured. Even though this risk is low in theory, you can shoot yourself in the foot in practice by improper configuration. –  schroeder May 2 '12 at 15:10
    
@HeavenCore - The risk of spoofing of an ip negligible. The risk of having an intranet website public isn't. –  Ramhound May 2 '12 at 18:43
add comment

I fail to understand how you can have:

1) an internet connection

2) terminal equipment

in a branch office but cannot have a VPN connection. It's certainly nothing to do with costs and resources. Indeed, that these allegedly have static addresses makes this argument even more absurd.

Other than that, this is a duplicate of Can I trust the source IP of an HTTP request?

While it would be tricky to access your server spoofing the IP address, this does not prevent, e.g. SYN flood attacks from a spoofed address. And what makes you think you won't be attacked by people on the same subnet as the branch offices (where it will likely be possible to spoof addresses).

share|improve this answer
    
"Absurd"? ha, if only my friend! The branch hardware is managed by a 3rd party and they charge us £800 to do the simplest things PER branch! But yes, I agree 100% with what you’re saying about the other people on the private network - ive already included this in my proposal - +1 –  HeavenCore May 2 '12 at 14:39
    
I don't think it's absurd either. I've been in similar situations. All it takes is a poor router/firewall or connection at the remote site that won't allow for VPN connections, and a year-long procurement process to get it replaced. And the OP is concerned about access, not attack. –  schroeder May 2 '12 at 15:06
    
It is indeed common practice with crackers to try to hack into a neighbouring system on the same subnet, just to be able to do more evil tricks (sniffing, MAC address spoofing, IP-address spoofing, CAM-table flooding, ...) –  jippie May 2 '12 at 15:37
    
Then perhaps installing a VPN and remote access software will save you money? –  symcbean May 3 '12 at 14:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.