0

We had following below iptables rules that exist in our web front-end boxes to prevent IP Spoofing:

    -A INPUT -s 255.0.0.0/8 -j LOG --log-prefix "Spoofed source IP"
    -A INPUT -s 255.0.0.0/8 -j DROP
    -A INPUT -s 0.0.0.0/8 -j LOG --log-prefix "Spoofed source IP"
    -A INPUT -s 0.0.0.0/8 -j DROP

We want to add below rules now to further harden IP Spoofing prevention

     -A INPUT -s 224.0.0.0/3 -j LOG --log-prefix "Spoofed source IP"
     -A INPUT -s 255.0.0.0/8 -j DROP
     -A INPUT –s 169.254.0.0/16 -j LOG --log-prefix "Spoofed source IP"
     -A INPUT -s 169.254.0.0/16 -j DROP
     -A INPUT –s 240.0.0.0/5 -j LOG --log-prefix "Spoofed source IP"
     -A INPUT -s 240.0.0.0/5 -j DROP

Do you suggest adding above rules in a production box running Apache httpd as a reverse proxy? This production box is behind a F5 load balancer.

Also, do we need to enable the below kernel parameters for the above rules to work effectively?

               net.ipv4.conf.all.rp_filter=1
               net.ipv4.conf.all.log_martians=1
               net.ipv4.conf.default.log_martians=1
  • 1
    echo 0 >/proc/sys/net/netfilter/nf_conntrack_tcp_loose Then when they start spoofing google.com or whatever you won't start block legit stuff. – cybernard Dec 26 '16 at 16:28
1
iptables -N spoofing
iptables -I spoofing -j LOG --log-prefix "Spoofed source IP"
iptables -I spoofing -j DROP

iptables -A INPUT -s 255.0.0.0/8 -j spoofing
iptables -A INPUT -s 0.0.0.8/8 -j spoofing

This saves you duplicating the log and drop rules over and over and over again.

You can't stop bad guys from spoofing. A spoof'ed ip can not perform a 3 way handshake as required by TCP, but UDP has no such restriction. Also if the hacker spoofs your IP and sends it to google.com or etc they will attempt to connect to your IP thinking you tried to connect to them.

Some ISP are now restricting this kind of thing, but many still don't.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.