I was studying firewalls and I came to think of this. I have a firewall configured as follows:

packet filter rule table to allow users of a corporate network to surf the web via HTTP and HTTPS

Now what happens if an attacker from the “outside” spoofs an IP address from the “inside” as their source address?

Could they then connect to a machine inside the corporate network? Why/not?

  • 3
    Packets with an internal network IP (192.168.*.*) sent over the Internet should be automatically dropped by the Internets Infrastructure. – AstroDan Jul 26 '16 at 17:57
  • If we ignore the above comment and assume that the attacking device is directly outside the firewall (i.e. on the same layer 2 network as the firewall's WAN interface), this still will not work because the firewall will not allow traffic to traverse from WAN to LAN interfaces without a specific rule in place allowing it. – multithr3at3d Jul 26 '16 at 18:05
  • I don't understand the context you've provided. The packet filter rule doesn't impact anyone else's ability to spoof your IP addresses. – Jesse K Jul 26 '16 at 19:49
  • @JesseKeilson Even I am unsure of the context, as I said this is an academic question from a certain resource. – Jishan Jul 26 '16 at 22:41

Typically, a protected internal network relies on more than just an IP address to determine whether something belongs on the network. This could include, but is not limited to, some sort of software (a la MS NAC/NAP), or physical controls (i.e. are you connected to an approved device). Moreover, typically the edge devices that do routing to your internal network will behave as described by korockinout13, and drop any traffic coming from outside that looks like it is coming from non-routable (i.e. internal) addresses.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.