1

I was studying firewalls and I came to think of this. I have a firewall configured as follows:

packet filter rule table to allow users of a corporate network to surf the web via HTTP and HTTPS

Now what happens if an attacker from the “outside” spoofs an IP address from the “inside” as their source address?

Could they then connect to a machine inside the corporate network? Why/not?

4
  • 3
    Packets with an internal network IP (192.168.*.*) sent over the Internet should be automatically dropped by the Internets Infrastructure.
    – AstroDan
    Commented Jul 26, 2016 at 17:57
  • If we ignore the above comment and assume that the attacking device is directly outside the firewall (i.e. on the same layer 2 network as the firewall's WAN interface), this still will not work because the firewall will not allow traffic to traverse from WAN to LAN interfaces without a specific rule in place allowing it. Commented Jul 26, 2016 at 18:05
  • I don't understand the context you've provided. The packet filter rule doesn't impact anyone else's ability to spoof your IP addresses.
    – Jesse K
    Commented Jul 26, 2016 at 19:49
  • @JesseKeilson Even I am unsure of the context, as I said this is an academic question from a certain resource.
    – Jishan
    Commented Jul 26, 2016 at 22:41

1 Answer 1

2

Typically, a protected internal network relies on more than just an IP address to determine whether something belongs on the network. This could include, but is not limited to, some sort of software (a la MS NAC/NAP), or physical controls (i.e. are you connected to an approved device). Moreover, typically the edge devices that do routing to your internal network will behave as described by korockinout13, and drop any traffic coming from outside that looks like it is coming from non-routable (i.e. internal) addresses.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .