Can one use ipopts, and in particular IP source routing, to circumvent source-based blocking in pf or iptables?
For example, with OpenBSD's pf:
block in all # default deny block out all pass in on dc0 from 10.0.0.0/8 to 10.1.1.1
Can IP source routing of TCP/IP packets over dc0 be used to circumnavigate (so to speak) the firewall rules and communicate with 10.1.1.1 from a network other than 10/8?
Even if possible, is such circumnavigation a viable or plausible attack if dc0 is public-facing? If so, can this be prevented?