We have a few Windows server VMs hosted in Amazon cloud. Users need to enter account and password to RDP to the VMs. The VMs’ RDP EndPoint (IP+Port) is public to the internet. As an extra security measure, we managed to restrict access to the RDP port (available to public) to specific public IP addresses.

The question is that how easy it is to spoof a public IP address? Can hackers spoof our designated public IP address, so they bypass our Pubic IP address firewalling? Thank you,


2 Answers 2


Short Answer

Assuming a TCP connection, it is nearly impossible to spoof a source IP address without control of the network.

Longer Answer

Assuming you are not using any proxies (which can cause issues if you're getting their IP address from a X-FORWARDED-FOR header), and running a service on TCP, it's extremely difficult to spoof a source IP address

To initialize a TCP connection multiple packets have to be sent back and forth between the server and the attacker. If the source address for the initial request is spoofed, then the attacker would be unable to finish opening the connection because the spoofed address is not their address. So when the server sends a packet 'back' to them, it would instead be directed to the real owner of the address and not the attacker.

I would make a diagram on Visio for this, but I am in class, so hopefully a sketch is sufficient.

TCP handshake

  • 2
    Notice that in some cases Real User might have a firewall configured in such a way that Server never receives the RST packet. In such a case the firewall can make the attack slightly easier to pull off, but it still is only feasible if Server uses predictable sequence numbers.
    – kasperd
    Nov 16, 2015 at 18:30

Spoofing the source address is fairly easy, there are still many ISPs that don't implement source address filtering.

Receiving the replies to those spoofed packets is harder. The attacker would need to either get on the network path between client and server or modify routing to change the network path. This is harder but certainly not impossible.

Modern TCP implementations use randomised sequence numbers which make the probability of successfully opening a TCP connection without receiving the reply to the SYN packet very low. Older systems and UDP based protocols may be more vulnerable to such attacks. Use of "SYN cookies" by the server also increases the probability of such an attack suceeding (though it's still a very low probability).

I would consider source IP filtering to be a useful extra line of defense but I would not want to rely on it as the sole means of protection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.