It says on Wikipedia that egress filtering 'verifies that the source IP address in all outbound packets is within the range of allocated internal address blocks' and on IP spoofing it says 'Ideally the gateway would also perform egress filtering on outgoing packets, which is blocking of packets from inside the network with a source address that is not inside'. It supposedly prevents IP spoofing.

But doesn't the router inherently prevent this by NAT/PATing all of the internalIPs:ephemeralPorts to external ones that are always going to take the form of the externalIP of the router, meaning that the source IP is never going to be spoofed regardless of what the original host spoofed it to?

  • You may be confusing “inside” or “internal” with “private IP addressing.” Yes, clearly source IP spoofing is meant to happen on public IP ranges, not private, non-routable addresses. The packet would just be dropped. – Appleoddity Nov 9 at 5:23
up vote 3 down vote accepted

Not all networks perform NAT. The only time you have to perform NAT is when you have just that one router with its public IP address, and the rest of your network has private ones.

The quote isn't about egress filtering at the edge of those networks. Instead it's mostly about filtering on networks where all devices already have public addresses and there's no NAT – such as a datacenter full of servers, or an ISP's network with all the customers in it.

How would those spoofed packets from customers reach the ISP's network, though? Easily.

  • A business customer might have its own pool of public addresses to assign to individual computers, servers, printers, or other devices.
  • Even a home connection, with its typical single address, isn't actually bound to using a router: the customer could just as well attach a single PC directly to the modem, and that computer would immediately have an external address.
  • Or as it has already happened on many occassions, a cheap router itself could be infected by malware and generating those spoofed packets on its own.

Finally, even when the network in question is one with NAT and private addresses, the question is whether its NAT rule is actually set up to match all source addresses... or just the private ones. It could very well be that some routers simply pass-through packets which already have a public source address, under the assumption that those have been "already NAT'ed".

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.