Given a Solaris machine with two network interfaces corresponding to the separate ethernet ports in the back.

• 0: 192.168.0.5/255.255.255.0
• 1: 192.168.1.5/255.255.255.0

with /etc/defaultrouter set to 192.168.0.1

If a connection (either TCP or UDP) comes in on port 0, but it is from 192.168.1.6 (obviously spoofed), does that mean that any responses (the SYN-ACK packet in the case of a TCP server, or the DNS response in case of a DNS server) will be sent out on port 1 (due to the IP address).

Or will they be dropped, or worse, will they be sent back out on port 0?

I am attempting to asses the risk of IP spoofing across physical interfaces. If a server listens on all interfaces, but only authorizes connections from 192.168.1.*, I want to know how likely it is that it will accept connections from the wrong port.

Hypothetical threat environment: port 1 is connected to trusted, non-internet network. Port 0's subnet might have a compromised machine on it.