We have an internal intranet system which is only accessible from a few internal VLANs. Our main external firewall blocks all access to the internal webserver – or rather, has no rules to allow access!
We have 100's of branches out in the UK that sit on a private network, most have VPNs to head office & access our intranet that way, there are however instances where we can’t arrange a VPN (politics, costing, resources etc) & we are considering opening our internal webserver to the internet with strict firewall rules to only allow traffic from the static IP's of the branches in question (let’s call this the whitelist).
Everyone knows that IP spoofing exists, and it's bordering on easy when you're on the same subnet. Can an IP be spoofed over the internet in a way that would make our internal webserver accessible from IP's not matching the branch whitelist?
To clarify, I know it's possible to spoof an IP over the internet, but I’ve never seen examples of 2-way communication, i.e. the webserver would try sending packets back to the faked IP, not the IP of the person faking the IP. So, is spoofing really a threat for our scenario?