IP address spoofing on internet

Question

On a local network, an attacker can craft a custom IP packet with a fake source IP address and send it to a host. I know that the attacker will not receive a response, but there are still attacks for which faking/spoofing the source IP in IP packets can be useful.

But how can this be done on the internet (faking public IP addresses)? If I want so send an IP packet with a fake public source IP address, and I'm sitting behind a router that is performing NAT, I assume the router will change the fake source IP in the IP packet to the real public IP of the router. I didn't find any options to switch off NAT for particular addresses on my router. Are there routers that have such options, or is that done somehow else? Has anyone of you done something like this before?

I know that there is a similar question/answer about what happens to a packet with faked source IP that goes through NAT, but it does not really answer my question. It explains the possible problem with NAT that I mentioned, but not how to avoid the problem.

Answer 1

Spoofing the source IP from your home Internet connection

Remove the NAT...

If your Internet connection works like most do (any ADSL or Cable connection that I've seen so far), then there is an easy way to remove the NAT at your end:

1. remove the router and replace it with a modem, or just remove the router if the modem is a separate box. Some (most) routers even allow to operate like a modem; In that case you just have to switch that in software and not actually replace the hardware.
2. directly connect your computer to the modem
3. setup the connection to your ISP on your computer. Most likely this will be a PPPoE connection with some kind of username/password that you got from your ISP.
4. Your computer is now directly connected to the Internet, without a NAT, or any kind of firewall except of any software on your computer and whatever the ISP has in place.

...or let the router do the spoofing for you

There are also routers which could do the IP spoofing for you. Any device that runs iptables and lets you configure the rules should do. OpenWRT capable devices come to mind here.

Some problems you are more or less likely to run into

Even if you don't have any NAT at your end of the connection, the ISP may still have a NAT that you have to go through. Also the ISP may filter out packets coming from your computer that do not have the source IP they assigned to you.

Have I done something like this before?

Yes, I have done something like this on a multihomed server (so I was substituting one of my IPs for the other) and it didn't work because of the filtering described above.

Answer 2

The above solution will never work for multiple reasons and part have been properly described by the user above.

If you could get the ISP to advertise a subnet belonging to the PI (provider independent) IP space of the victim then you might be able to do it. The ISPs are not so easy to convince to do that, I know... but you can convince them to establish a BGP session with you and your own AS where you advertise whatever you want.

Some filtering might still be in place outbound but in this way, you skip a couple of levels of ISP's security. Also, remember that there are organizations that let you VPN everywhere and you might also want to try to BGP with a remote ISP through a secure VPN.