IP Spoofing a threat?

Question

We have an internal intranet system which is only accessible from a few internal VLANs. Our main external firewall blocks all access to the internal webserver – or rather, has no rules to allow access!

We have 100's of branches out in the UK that sit on a private network, most have VPNs to head office & access our intranet that way, there are however instances where we can’t arrange a VPN (politics, costing, resources etc) & we are considering opening our internal webserver to the internet with strict firewall rules to only allow traffic from the static IP's of the branches in question (let’s call this the whitelist).

Everyone knows that IP spoofing exists, and it's bordering on easy when you're on the same subnet. Can an IP be spoofed over the internet in a way that would make our internal webserver accessible from IP's not matching the branch whitelist?

To clarify, I know it's possible to spoof an IP over the internet, but I’ve never seen examples of 2-way communication, i.e. the webserver would try sending packets back to the faked IP, not the IP of the person faking the IP. So, is spoofing really a threat for our scenario?

Answer 1

IP spoofing on the Internet relies on misconfiguration of so many routers and firewalls that a packet has to travel all these (all in turn administered by different parties) that the chance it works is 0. Routers commonly filter incoming IP's / outgoing IP's on what they expect to see.

Answer 2

The term to search for is "BGP hijacking".

The risk is low but non-zero. If an attacker can find a sufficiently sloppy ISP they can advertise their own route for the IP range block containing your clients IP. With sufficient sophistication they may even be able to set things up so they hijack the traffic from HQ to branch and then return most of it to the branch.

Now finding a sufficiently sloppy ISP may be difficult and the loophole is likely to be closed once the bogus route is discovered but there is certainly a window of opportunity there.

Answer 3

I fail to understand how you can have:

1) an internet connection

2) terminal equipment

in a branch office but cannot have a VPN connection. It's certainly nothing to do with costs and resources. Indeed, that these allegedly have static addresses makes this argument even more absurd.

Other than that, this is a duplicate of Can I trust the source IP of an HTTP request?

While it would be tricky to access your server spoofing the IP address, this does not prevent, e.g. SYN flood attacks from a spoofed address. And what makes you think you won't be attacked by people on the same subnet as the branch offices (where it will likely be possible to spoof addresses).