For an external firewall interface, why is it a good idea to validate that the source IP address was initiated from an internal IP, or why it originated from an external IP? If, hypothetically, the firewall was not looking for this information, what security concerns exist?

  • It is all about concept of firewall. You don't want people from internet to spoof as one of your internal IP to roams freely inside your intranet. – mootmoot Jul 27 '16 at 14:05
  • So, from an attacker perspective the following would be possible ? if i send a packet to the firewall originating externally, and set the Sender IP to be an internal IP address, I would be able to flood the internal HOST device ? – Darragh Jul 27 '16 at 14:10
  • Check out this question: security.stackexchange.com/questions/131084/… – AstroDan Jul 27 '16 at 15:35
  • en.wikipedia.org/wiki/IP_address_spoofing. Assume the filtering as part of most packet-filter firewall. – mootmoot Jul 27 '16 at 17:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.