iptables drop fake ip packets

Question

I'm trying to drop all packets from the internet that use a fake ip address so they appear to come locally.

Do I need both lines or only the first ?

--append INPUT ! --in-interface lo --source 127.0.0.0/8 --jump DROP

--append INPUT ! --in-interface lo --destination 127.0.0.0/8 --jump DROP

Answer 1

You could use both, neither should exist really so blocking shouldn't hurt.

I'd also add rules for blocking non-routing IPs coming from outside your network.