Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a home-made web application and thought that an easy way to secure it's administration interface would be to simply reject all IPs that arent from 192.168... Is this viable? is it possible for someone to spoof LAN IPs on the Internet?

And if it's possible, wouldn't it be standard to add an iptables rule to reject all LAN IPs from the "internet interface"?

share|improve this question
Anti-spoofing is an option/feature of almost all routers these days. – Rory Alsop Nov 17 '13 at 11:08
up vote 3 down vote accepted

In practice this is likely to be a reasonable protection, but from an ideal standpoint you shouldn't rely on it. Apart from anything else it disregards the possibility that an attacker can get access to a machine on your local LAN (e.g. if one of your systems gets infected by malware)

In terms of having iptables reject LAN IPs from the Internet, yep this is a standard practice known as Bogon Filtering

share|improve this answer

If you are behind a nat/router/firewall then you should need to open the service port you want to be accessible there. Don't open the admin port and have it on a different port to the application (e.g. if its web app and web admin have one on 80 and one on 8080).

Then sure, defend on the box as well, block all off-lan traffic.

But one day you might want to administer it remotely. So if it is web admin use https with certificate based authentication.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.