I have a home-made web application and thought that an easy way to secure it's administration interface would be to simply reject all IPs that arent from 192.168... Is this viable? is it possible for someone to spoof LAN IPs on the Internet?

And if it's possible, wouldn't it be standard to add an iptables rule to reject all LAN IPs from the "internet interface"?

  • 2
    Anti-spoofing is an option/feature of almost all routers these days.
    – Rory Alsop
    Nov 17, 2013 at 11:08

2 Answers 2


In practice this is likely to be a reasonable protection, but from an ideal standpoint you shouldn't rely on it. Apart from anything else it disregards the possibility that an attacker can get access to a machine on your local LAN (e.g. if one of your systems gets infected by malware)

In terms of having iptables reject LAN IPs from the Internet, yep this is a standard practice known as Bogon Filtering


If you are behind a nat/router/firewall then you should need to open the service port you want to be accessible there. Don't open the admin port and have it on a different port to the application (e.g. if its web app and web admin have one on 80 and one on 8080).

Then sure, defend on the box as well, block all off-lan traffic.

But one day you might want to administer it remotely. So if it is web admin use https with certificate based authentication.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .