5

On a local network, an attacker can craft a custom IP packet with a fake source IP address and send it to a host. I know that the attacker will not receive a response, but there are still attacks for which faking/spoofing the source IP in IP packets can be useful.

But how can this be done on the internet (faking public IP addresses)? If I want so send an IP packet with a fake public source IP address, and I'm sitting behind a router that is performing NAT, I assume the router will change the fake source IP in the IP packet to the real public IP of the router. I didn't find any options to switch off NAT for particular addresses on my router. Are there routers that have such options, or is that done somehow else? Has anyone of you done something like this before?

I know that there is a similar question/answer about what happens to a packet with faked source IP that goes through NAT, but it does not really answer my question. It explains the possible problem with NAT that I mentioned, but not how to avoid the problem.

  • 1
    you need to be on the other side of the NAT for spoofing to work - you can tunnel to do that, or to configure NAT if you have admin access, but the ultimate answer is to be on the other side – schroeder Oct 9 '15 at 16:35
  • Any good ISP should filter the packets on their own routers and only allow those with the source IP set to your legitimate IP, dropping any packets with a spoofed or invalid (private network IPs like 10.0.0.1) IP. And the same filtering could be applied upstream between ISPs themselves - let's say an ISP announces their IP block 1.2.3.0/24, so other ISPs should't accept packets from them if the source isn't in this IP block. – André Borie Dec 14 '15 at 9:32
4

Spoofing the source IP from your home Internet connection

Remove the NAT...

If your Internet connection works like most do (any ADSL or Cable connection that I've seen so far), then there is an easy way to remove the NAT at your end:

  1. remove the router and replace it with a modem, or just remove the router if the modem is a separate box. Some (most) routers even allow to operate like a modem; In that case you just have to switch that in software and not actually replace the hardware.
  2. directly connect your computer to the modem
  3. setup the connection to your ISP on your computer. Most likely this will be a PPPoE connection with some kind of username/password that you got from your ISP.
  4. Your computer is now directly connected to the Internet, without a NAT, or any kind of firewall except of any software on your computer and whatever the ISP has in place.

...or let the router do the spoofing for you

There are also routers which could do the IP spoofing for you. Any device that runs iptables and lets you configure the rules should do. OpenWRT capable devices come to mind here.

Some problems you are more or less likely to run into

Even if you don't have any NAT at your end of the connection, the ISP may still have a NAT that you have to go through. Also the ISP may filter out packets coming from your computer that do not have the source IP they assigned to you.

Have I done something like this before?

Yes, I have done something like this on a multihomed server (so I was substituting one of my IPs for the other) and it didn't work because of the filtering described above.

  • If you're not trying spoof a public IP address that is in the same network as your IP it should not working. The internet gateway is not allowed to route this traffic, so "may filter" is not the correct term. Your ISP will not route your traffic. – sven.to Sep 6 '16 at 18:15
  • @sven.to but the ISP is the entity that decides which traffic their routers are allowed to forward, is it not? Also I'm pretty sure that there are misconfigured routers out there. Of course for the packet to reach it's destination, all routers on the path have to allow for the packet to be sent. However, when the packet gets closer to it's destination it will probably become harder to detect the source addr. to be spoofed. – Daniel Sep 8 '16 at 17:19
  • From home internet spoofing won't work if your ISP using anti-spoofing ACL on their router, which will prevent to use spoofing – Satish Oct 31 '16 at 14:43
2

The above solution will never work for multiple reasons and part have been properly described by the user above.

If you could get the ISP to advertise a subnet belonging to the PI (provider independent) IP space of the victim then you might be able to do it. The ISPs are not so easy to convince to do that, I know... but you can convince them to establish a BGP session with you and your own AS where you advertise whatever you want.

Some filtering might still be in place outbound but in this way, you skip a couple of levels of ISP's security. Also, remember that there are organizations that let you VPN everywhere and you might also want to try to BGP with a remote ISP through a secure VPN.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.