Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I've read that a common attack is spoofing packets from internal SRC IP addresses, such as How can I defend against this with iptables, yet at the same time allow traffic from the router or anything else essential?

If I just added a -s -j DROP to the INPUT chain that would kill genuine internal traffic too?

share|improve this question

One simple answer. Specify the interface for rules... not just the source IP/ports.

for example

iptables -I INPUT -i eth0 -s -j DROP
iptables -I FORWARD -i eth0 -s -j DROP

(assuming eth0 is your WAN interface)

share|improve this answer
Thanks, how does this know these are "spoofed", i.e. come from the external, big bad internet rather than being genuine internal packets (e.g. from my router)? (just wondering....) – fpghost Jul 7 '13 at 7:50
Forgive my ignorance: is eth0 the router then? Hence with your rules above, we know that if say is coming on eth0 then it's an external packet hitting the router yet pretending to on local network? – fpghost Jul 7 '13 at 16:07
So on reflection eth0 appears to my wired laptop network card, whereas eth1 is my wireless laptop network card. I am connecting from the wireless eth1 device..All traffic is coming through eth1 though, whether the src is external or whether its say the router on Hence using -i eth1 would drop for both genuine internal packets and external spoofs? – fpghost Jul 7 '13 at 20:50
Sorry for the long-delay. These firewall rules should be applied IN the router. Not on a laptop. A laptop would have no way of knowing if this came from the Internet or from the local network. As a rule, spoofed packets should never make it past your router. – TheCompWiz Jul 10 '13 at 13:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .