10.5. Source Address Filtering
All IP packet headers contain the source and destination IP addresses and the type of IP protocol message; ICMP, UDP or TCP this packet contains. The only means of identification under the Internet Protocol - IP) is the source address in the IP packet header. This is a problem that opens the door to source address spoofing, where the sender may replaces its address with either a nonexistent address, or the address of some other site.
# Refuse spoofed packets pretending to be from the external address.
ipchains -A input -i $EXTERNAL_INTERFACE -s $IPADDR -l -j DENY
|
Also, there are at least seven sets of source addresses you should refuse on your external interface in all cases. These are incoming packets claiming to be from:
-
Your external IP address
-
Class A private IP addresses
-
Class B private IP addresses
-
Class C private IP addresses
-
Class D multicast addresses
-
Class E reserved addresses
-
The loopback interface
: Don't forget to exclude your own IP address from outgoing packets blocked. By default I choose to exclude the Class C private IP addresses since it's the most used by the majority of people at this time. If you used another class instead of the Class C, then you must comment out the lines that refer to your class under the SPOOFING & BAD ADDRESSES section of the firewall. script file.
The rest of the rules used in the firewall scripts files are:
-
Accessing a Service from the Outside World
-
Offering a Service to the Outside World
-
Masquerading the Internal Machines