One thing I've noticed is that the idea of "spoofing" the source IP address gets brought up but people rarely go into detail about how challenging that might be in practice (eg, accurately guessing TCP sequence numbers), so I'd be interested in any opinions about the practicality of spoofing IP addresses with common application protocol such as HTTP.
A fair point which earns my +1.
If you're after hijacking an existing connection given you know for arguments' sake that
2188.8.131.52 (deliberately not real) is on the whitelist is fairly tough, as you state.
I think we reach for IP spoofing as the most obvious threat, like with the idea that all hackers are "leet", use tiling window managers and have transparent terminals. However, there are some more obvious problems:
- What happens if another computer acquires that IP address? If you use IP address based restrictions alone, then it becomes a problem.
- What happens if that computer becomes compromised? Again, a problem if you use IP address filtering alone.
- What happens when you have NAT and no access to the source IP address?
In other words, the problem is that whilst this might restrict access, it does nothing to check authorisation. Like a stateless firewall, which assumes everyone on this private subnet is good. That's all very well, but did you authorise their access? If they can acquire, by any means, an IP address in the right range, you're going to hand them trust.
By contrast, if you use some form of authentication layer, you make it harder for the would be attacker to gain access where they are not authorised.
A better solution in my mind is to use the likes of IPtables to mark certain interfaces as having access to more or fewer services. This is then tied to the physical network, which is much harder for an external (or even internal) attacker to manipulate. You still, however, need authentication on top of that.