Re: Automatic antispoofing rules on access servers.

[Ben Galehouse <bgalehou () PACBELL NET>]

> LOS Ralph wrote:
>
> We are using a SonicWall for security on some branch offices.  I've
> had very good success with this product in blocking spoofed IP
> traffic.  All the firewall will do is log the traffic, yell at the
> admin receiving alerts, and drop the spoofed traffic before it passes
> the firewall - or so I'm told.  I've not had time to research this
> more thoroughly as I'm not well-versed in spoofing IP's (yet).
>
> ....and that's my $0.02

The typical prepackaged firewall configuration will only block things so
badly spoofed that there is no way that the return address could be
real.  E.G. A packet with an address from the 10.0.0.0/8 subnet should
never be seen outside of a private network.  So if such comes in from
your dsl provider, it is a no brainer to drop it on the floor. I think
that most consumer grade firewalls mean this when they advertise
spoofing protection.

If you are only managing a single subnet, this is about as much
protection as you would get from the cisco rpf stuff.  There is only one
route, and if something comes in from the outside with a real IP that
you don't own, you can't tell if it was spoofed.

Once you have multiple subnets with static routes between them, you can
hand write packet filter rules to protect you from internal spoofing.
Packets from this subnet should not be heading out of that subnet, etc.
Once you have dynamic routes, the cisco rpf stuff starts to look real
exciting.  External spoofing protection is still little better than the
abovementioned 'drop those from private nets' because there isn't do
much better.

When your topology is simple in the sense that you have all untrusted
clients within subnets, each subnet having one router connecting to a
backbone, then there is a simpler (and cheaper) approach which
accomplishes the same thing.  Add a rule to each router which only lets
out packets who's return address is in the subnet.  While you'll never
know for certain which machine a packet came from, you'll at least know
that your resident script kiddies are more limited in who they can
pretend to be.