Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

So I've read that a common attack is spoofing packets from internal SRC IP addresses, such as 192.168.0.0/16. How can I defend against this with iptables, yet at the same time allow traffic from the router or anything else essential?

If I just added a -s 192.168.0.0/16 -j DROP to the INPUT chain that would kill genuine internal traffic too?

share|improve this question
add comment

1 Answer 1

One simple answer. Specify the interface for rules... not just the source IP/ports.

for example

iptables -I INPUT -i eth0 -s 192.168.0.0/16 -j DROP
iptables -I FORWARD -i eth0 -s 192.168.0.0/16 -j DROP

(assuming eth0 is your WAN interface)

share|improve this answer
    
Thanks, how does this know these are "spoofed", i.e. come from the external, big bad internet rather than being genuine internal packets (e.g. from my router)? (just wondering....) –  fpghost Jul 7 '13 at 7:50
    
Forgive my ignorance: is eth0 the router then? Hence with your rules above, we know that if say 192.168.0.80 is coming on eth0 then it's an external packet hitting the router yet pretending to on local network? –  fpghost Jul 7 '13 at 16:07
    
So on reflection eth0 appears to my wired laptop network card, whereas eth1 is my wireless laptop network card. I am connecting from the wireless eth1 device..All traffic is coming through eth1 though, whether the src is external or whether its say the router on 192.168.1.254. Hence using -i eth1 would drop 192.168.0.0/16 for both genuine internal packets and external spoofs? –  fpghost Jul 7 '13 at 20:50
1  
Sorry for the long-delay. These firewall rules should be applied IN the router. Not on a laptop. A laptop would have no way of knowing if this came from the Internet or from the local network. As a rule, spoofed packets should never make it past your router. –  TheCompWiz Jul 10 '13 at 13:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.