6

We have an internal intranet system which is only accessible from a few internal VLANs. Our main external firewall blocks all access to the internal webserver – or rather, has no rules to allow access!

We have 100's of branches out in the UK that sit on a private network, most have VPNs to head office & access our intranet that way, there are however instances where we can’t arrange a VPN (politics, costing, resources etc) & we are considering opening our internal webserver to the internet with strict firewall rules to only allow traffic from the static IP's of the branches in question (let’s call this the whitelist).

Everyone knows that IP spoofing exists, and it's bordering on easy when you're on the same subnet. Can an IP be spoofed over the internet in a way that would make our internal webserver accessible from IP's not matching the branch whitelist?

To clarify, I know it's possible to spoof an IP over the internet, but I’ve never seen examples of 2-way communication, i.e. the webserver would try sending packets back to the faked IP, not the IP of the person faking the IP. So, is spoofing really a threat for our scenario?

Improve this question

3 Answers 3

Reset to default
1

IP spoofing on the Internet relies on misconfiguration of so many routers and firewalls that a packet has to travel all these (all in turn administered by different parties) that the chance it works is 0. Routers commonly filter incoming IP's / outgoing IP's on what they expect to see.

Improve this answer
3
  • @jippie is correct, but you do have to make sure that your firewall rules are properly configured. Even though this risk is low in theory, you can shoot yourself in the foot in practice by improper configuration.
    – schroeder ♦
    May 2, 2012 at 15:10
  • 1
    @HeavenCore - The risk of spoofing of an ip negligible. The risk of having an intranet website public isn't.
    – Ramhound
    May 2, 2012 at 18:43
  • misconfiguration is only necessary if you're attacker is hoping to get something back. No router is going to drop a packet with a perfectly legit (but spoofed) source IP just because it doesn't normally see that source IP coming across it.
    – Angelo Schilling
    Jul 28, 2018 at 0:04
3

The term to search for is "BGP hijacking".

The risk is low but non-zero. If an attacker can find a sufficiently sloppy ISP they can advertise their own route for the IP range block containing your clients IP. With sufficient sophistication they may even be able to set things up so they hijack the traffic from HQ to branch and then return most of it to the branch.

Now finding a sufficiently sloppy ISP may be difficult and the loophole is likely to be closed once the bogus route is discovered but there is certainly a window of opportunity there.

Improve this answer
1

I fail to understand how you can have:

1) an internet connection

2) terminal equipment

in a branch office but cannot have a VPN connection. It's certainly nothing to do with costs and resources. Indeed, that these allegedly have static addresses makes this argument even more absurd.

Other than that, this is a duplicate of Can I trust the source IP of an HTTP request?

While it would be tricky to access your server spoofing the IP address, this does not prevent, e.g. SYN flood attacks from a spoofed address. And what makes you think you won't be attacked by people on the same subnet as the branch offices (where it will likely be possible to spoof addresses).

Improve this answer
4
  • "Absurd"? ha, if only my friend! The branch hardware is managed by a 3rd party and they charge us £800 to do the simplest things PER branch! But yes, I agree 100% with what you’re saying about the other people on the private network - ive already included this in my proposal - +1
    – HeavenCore
    May 2, 2012 at 14:39
  • I don't think it's absurd either. I've been in similar situations. All it takes is a poor router/firewall or connection at the remote site that won't allow for VPN connections, and a year-long procurement process to get it replaced. And the OP is concerned about access, not attack.
    – schroeder ♦
    May 2, 2012 at 15:06
  • It is indeed common practice with crackers to try to hack into a neighbouring system on the same subnet, just to be able to do more evil tricks (sniffing, MAC address spoofing, IP-address spoofing, CAM-table flooding, ...)
    – jippie
    May 2, 2012 at 15:37
  • Then perhaps installing a VPN and remote access software will save you money?
    – symcbean
    May 3, 2012 at 14:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .