Can one use ipopts, and in particular IP source routing, to circumvent source-based blocking in pf or iptables?

For example, with OpenBSD's pf:

block in  all # default deny
block out all
pass in  on dc0 from to

Can IP source routing of TCP/IP packets over dc0 be used to circumnavigate (so to speak) the firewall rules and communicate with from a network other than 10/8?

Even if possible, is such circumnavigation a viable or plausible attack if dc0 is public-facing? If so, can this be prevented?

  • Do you mean using dc0 on the same machine as the pf or iptables? – this.josh Jun 27 '11 at 5:17
  • @this.josh: Yes exactly, dc0 on the same machine as the firewall. – Brian M. Hunt Jun 28 '11 at 13:39

For incoming packets, packet filtering (call to pf_test on line 367) is done before option processing (call to ip_dooptions on line 384) in ip_input.c

For outgoing packets, routing (starting on line 170) is done before packet filtering (call to pf_test on line 691) in ip_output.c

So, if the packet filtering is working correctly, then no, source routing will not circumvent the firewall, because for incoming packets source routing is not applied until after filtering, and for outgoing packets filtering is done after source routing is applied.


I don't know specifically whether it can bypass these particular firewalls, but my superficial impression is that most firewalls block source routing, specifically because of these kinds of threats.

  • What do you mean by "disable"? Reject ingress packets that have any source routing? – Brian M. Hunt Jun 26 '11 at 20:23
  • @Brian, yes, exactly. Thank you for helping me clarify. – D.W. Jun 27 '11 at 6:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.