Spoofing and guest network security

Question

I know a little bit about network security but it's only about enough to know there's a lot I don't know. My requirement is to add a 2nd wifi to my current setup (1 wifi emitted by a 1-physical-wifi-radio OpenWRT router; and a bunch of computers connected to the wifi) and to prevent users of the 2nd wifi from accessing my router config page and any services running on any of my own devices (e.g., non-Internet-visible file shares and servers).

My current security measures are iptables rules that prevent 2nd-wifi-user access to my original network based on source IPs or source interfaces. My fear is that these may not be sufficient.

(option 1: ip-based filtering)
iptables -I FORWARD -s $GUEST_SUBNET -d $HOME_SUBNET -j REJECT

(option 2: interface-based filtering)
iptables -I FORWARD -i $GUEST_INTERFACE -d $HOME_SUBNET -j REJECT

I don't know much about spoofing but it seems to me that if a 2nd-wifi-user "doctored" his requests to the router configuration page (that sits within $HOME_SUBNET) as being from a source IP within $HOME_SUBNET, he could access and interact with the configuration page since he'd be able to sniff all of the traffic to the fake source IP address and construct sensible responses. Right?

1. If I'm wrong, and my iptables rules are in fact sufficient, could someone please explain why a spoof is not possible given my rules and reasoning.

2. Otherwise, does the encryption on my home wifi play a role in this? For instance, if my home wifi was WEP/WPA2/802.1x-encrypted, then would the response to the fake $HOME_SUBNET source IP be encrypted as well and thus be unreadable to my guests (thereby effectively securing my home network from my guests)? This seems sensible...

Thanks!

PS: this question follows from a recent question of mine and the responses I received for it.

EDIT: Just to be clear, my home wifi and guest wifi are emitted by the same router.

Answer 1

This is not possible. The configuration interface of a router is running HTTP, which uses TCP at layer 4. For TCP connection to be succesful to start talking HTTP at layer 7, you would need to have the following handshake:

The problem with IP spoofing in regards to TCP is that this is not possible. With just IP filtering you will be able to send the first SYN past the firewall, but your router will respond to the person having the actual IP with SYN-ACK, meaning you will never be able to send ACK. This means there is no handshake possible and thus you will not be able to talk HTTP to your router.