I know a little bit about network security but it's only about enough to know there's a lot I don't know. My requirement is to add a 2nd wifi to my current setup (1 wifi emitted by a 1-physical-wifi-radio OpenWRT router; and a bunch of computers connected to the wifi) and to prevent users of the 2nd wifi from accessing my router config page and any services running on any of my own devices (e.g., non-Internet-visible file shares and servers).

My current security measures are iptables rules that prevent 2nd-wifi-user access to my original network based on source IPs or source interfaces. My fear is that these may not be sufficient.

(option 1: ip-based filtering)

(option 2: interface-based filtering)

I don't know much about spoofing but it seems to me that if a 2nd-wifi-user "doctored" his requests to the router configuration page (that sits within $HOME_SUBNET) as being from a source IP within $HOME_SUBNET, he could access and interact with the configuration page since he'd be able to sniff all of the traffic to the fake source IP address and construct sensible responses. Right?

  1. If I'm wrong, and my iptables rules are in fact sufficient, could someone please explain why a spoof is not possible given my rules and reasoning.

  2. Otherwise, does the encryption on my home wifi play a role in this? For instance, if my home wifi was WEP/WPA2/802.1x-encrypted, then would the response to the fake $HOME_SUBNET source IP be encrypted as well and thus be unreadable to my guests (thereby effectively securing my home network from my guests)? This seems sensible...


PS: this question follows from a recent question of mine and the responses I received for it.

EDIT: Just to be clear, my home wifi and guest wifi are emitted by the same router.

1 Answer 1


This is not possible. The configuration interface of a router is running HTTP, which uses TCP at layer 4. For TCP connection to be succesful to start talking HTTP at layer 7, you would need to have the following handshake:

enter image description here

The problem with IP spoofing in regards to TCP is that this is not possible. With just IP filtering you will be able to send the first SYN past the firewall, but your router will respond to the person having the actual IP with SYN-ACK, meaning you will never be able to send ACK. This means there is no handshake possible and thus you will not be able to talk HTTP to your router.

  • thanks for the answer! i'm aware of TCP handshakes but wouldn't it be possible for the guest to sniff the SYN-ACK and thus be able to send a proper ACK?
    – rmanna
    Commented Jan 18, 2014 at 8:52
  • How would you sniff the syn-ack packet? Commented Jan 18, 2014 at 9:13
  • I mean you are supposed to be on a different wireless network for which you do not have the password. I suppose that those two networks are interconnected using a physical cable. Why would your router A expose a SYN-ACK packet to router B if the destinary IP is on router A? Commented Jan 18, 2014 at 9:18
  • What I don't understand is why you are even routing between your two routers. Just don't route. Commented Jan 18, 2014 at 9:19
  • both wifis are emitted by the same router (i guess that might not have been clear, i'll edit my question). that means 2nd-wifi clients can sniff traffic for the 1st wifi right?
    – rmanna
    Commented Jan 18, 2014 at 9:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .