Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
While reading up on iptables, I saw this article from NixCraft recommending that a server block the following bad addresses:
It doesn't say whether it is applicable for UDP, TCP or all traffic. My web server has an application running on TCP 127.0.0.1. I am more worried about spoofed source IP addresses like 0.0.0.0 or 127.0.0.1 reaching my server on TCP.
Seriously, is that possible at all?
Spoofing an IP address is possible, though not very easy to do for the average person. The reason being that most ISP's will drop spoofed packets as they leave your network. This is even more applicable to bogons as they are generally filtered at the ISP level, and border firewalls.
If a spoofed packet does make it to your server, you should understand that there is no valid return path for that packet. An attacker spoofing an IP address would not be able to see any data from the server itself, but it could still be used in something like an amplification attack or to trigger an event within the servers services.
When talking about reserved private addresses, the likelihood of them hitting your network is very slim. Just because something is unlikely doesn't mean it is impossible.
The idea is that you should not be accepting these packets through your public interface, because what lies on the other side is not trusted. Just because your ISP should and most likely does filter these doesn't mean that you should not be doing the same.
You should block those addresses for all traffic because there is no valid reason for a packet bound from or to one of those addresses to be on the Internet at large. Any packet with one of those addresses represents an attack, a misconfiguration, or both.
0.0.0.0/8: A set of "wildcard" addresses representing the current network.
127.0.0.0/8: The loopback addresses. Packets with these addresses should never leave the computer they're created on.
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16: Private-use addresses. Packets with these addresses should never leave the LAN they're on. These represent the greatest threat, since forging one of these as the destination address can let the attacker target computers that are not directly addressable from the rest of the Internet, and thus may not have the same level of security as a server; forging one as the source address can trick the destination computer into attacking one of those non-addressable computers.
224.0.0.0/3: The multicast and reserved address ranges. I'm not sure why the article says to block them.
As for how these packets can be created, any program with low-level access to the computer's hardware can create completely customized packets, including doing such things as forging the "from" address on the packet.
