Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a home-made web application and thought that an easy way to secure it's administration interface would be to simply reject all IPs that arent from 192.168... Is this viable? is it possible for someone to spoof LAN IPs on the Internet?

And if it's possible, wouldn't it be standard to add an iptables rule to reject all LAN IPs from the "internet interface"?

share|improve this question
2  
Anti-spoofing is an option/feature of almost all routers these days. –  Rory Alsop Nov 17 '13 at 11:08
add comment

2 Answers

up vote 3 down vote accepted

In practice this is likely to be a reasonable protection, but from an ideal standpoint you shouldn't rely on it. Apart from anything else it disregards the possibility that an attacker can get access to a machine on your local LAN (e.g. if one of your systems gets infected by malware)

In terms of having iptables reject LAN IPs from the Internet, yep this is a standard practice known as Bogon Filtering

share|improve this answer
add comment

If you are behind a nat/router/firewall then you should need to open the service port you want to be accessible there. Don't open the admin port and have it on a different port to the application (e.g. if its web app and web admin have one on 80 and one on 8080).

Then sure, defend on the box as well, block all off-lan traffic.

But one day you might want to administer it remotely. So if it is web admin use https with certificate based authentication.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.