Linux Iptables Avoid IP Spoofing And Bad Addresses Attacks

by on June 28, 2005 · 17 comments· LAST UPDATED February 19, 2014

in , ,

Spoofing and bad address attack tries to fool the server and try to claim that packets had come from local address/network.

Following IP/netwok address are know to open this kind of attack:

Incoming source IP address is your servers IP address

Bad incoming address from following ranges:

  • 0.0.0.0/8
  • 127.0.0.0/8
  • 10.0.0.0/8
  • 172.16.0.0/12
  • 192.168.0.0/16
  • 192.168.0.0/16
  • 224.0.0.0/3
  • Your own internal server/network ip address/ranges.

Following small shell script tries to prevent this kind of attacks:

#!/bin/bash
 
INT_IF="eth1" # connected to internet 
SERVER_IP="202.54.10.20" # server IP
LAN_RANGE="192.168.1.0/24" # your LAN IP range 
 
# Add your spoofed IP range/IPs here
SPOOF_IPS="0.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 224.0.0.0/3"
 
IPT="/sbin/iptables" # path to iptables
 
# default action, can be DROP or REJECT 
ACTION="DROP"
 
# Drop packet that claiming from our own server on WAN port
$IPT -A INPUT -i $INT_IF -s $SERVER_IP -j $ACTION
$IPT -A OUTPUT -o $INT_IF -s $SERVER_IP -j $ACTION
 
# Drop packet that claiming from our own internal LAN on WAN port
$IPT -A INPUT -i $INT_IF -s $LAN_RANGE -j $ACTION
$IPT -A OUTPUT -o $INT_IF -s $LAN_RANGE -j $ACTION
 
## Drop all spoofed 
for ip in $SPOOF_IPS
do
 $IPT -A INPUT -i $INT_IF -s $ip -j $ACTION
 $IPT -A OUTPUT -o $INT_IF -s $ip -j $ACTION
done
## add or call your rest of script below to customize iptables ##
 

Save and close the file. Call above script from your own iptables script. Add following line to your /etc/sysctl.conf file
net.ipv4.conf.all.rp_filter=1
net.ipv4.conf.all.log_martians=1
net.ipv4.conf.default.log_martians=1

The net.ipv4.conf.all.rp_filter=1 entry enables source address verification which is inbuilt into Linux kernel itself and last two lines logs all such spoofed packets in log file.

TwitterFacebookGoogle+PDF versionFound an error/typo on this page? Help us!

{ 17 comments… read them below or add one }

1 Prerak Doshi November 23, 2006 at 7:30 am

Hi,
How to configure squid as a direct connection?
I would like to following option enable through squid
1. Username password security with individual site Blocking security.
2. FTP, SMTP, POP3 etc.. protocol and port configure.
3. Cache configuration
4. log maintenance of internet usage, bad site request, downloading, uploading with user name.
5. firewall configuration to block intruders.(Apart from local user nobody outside the LAN can use our port and connection to the internet
6. Antivirus : Clamav

Reply

2 nixCraft November 23, 2006 at 9:20 am

Prerak

You are using Red hat Linux…..????

Reply

3 Ash December 28, 2006 at 4:38 pm

- iptables -A INPUT -s -j DROP
+ iptables -A INPUT -s $ip -j DROP

Reply

4 nixCraft December 28, 2006 at 6:04 pm

Ash,

PHP treated $ip as PHP variable. But now it is fixed.

Appreciate your post.

Reply

5 budi August 6, 2007 at 11:39 pm

Address 127.0.0.0/8 is used by server mail or other server like dns or /etc/hosts. And if was blocked the server no running, how solve it?

Reply

6 Muhammad Kamran Azeem April 10, 2008 at 4:16 pm

I think that the following code:,

# Original code – Start
SERVER_IP=”202.54.10.20”
# Add your IP range/IPs here,
SPOOF_IPS=”0.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 224.0.0.0/3”
iptables -A INPUT -s $SERVER_IP -j DROP
for ip in $SPOOF_IPS
do
iptables -A INPUT -s $ip -j DROP
done
# Original Code – End

, can be re-written as :-

# Suggested Code – Start
PUBLICIF=eth0
SERVER_IP=202.54.10.20
# Add your IP range/IPs here,
SPOOF_IPS=”$SERVER_IP 0.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/16 192.168.0.0/16 224.0.0.0/3″
for ip in $SPOOF_IPS
do
iptables -A INPUT -i $PUBLICIF -s $ip -j DROP
done

# Suggested code – Stop

Please correct me if I am wrong, but IMHO, if we DROP packets without mentioning the interface then legitimate connections originating from the same server on loopback (lo) will also get dropped.

Thanks.

Reply

7 Muhammad Kamran Azeem April 10, 2008 at 5:29 pm

Sorry. This line:-
SPOOF_IPS=”$SERVER_IP 0.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/16 192.168.0.0/16

Should not contain $SERVER_IP and should instead be:-

SPOOF_IPS=”0.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/16 192.168.0.0/16

Reply

8 Gunjan July 9, 2008 at 6:35 am

Yes we need to be remove $SERVER_IP from SPOOF_IPS other wise server also block and we do not have any access to server

Reply

9 nixCraft July 9, 2008 at 11:21 am

Gunjan,

The script has been updated to only filter on public interface. This should fix the issue.

Reply

10 kwik August 4, 2008 at 7:20 pm

It is impossible to spoof your address if your Linux computer is behind NAT enabled router such as Cisco.

This script is more useful on *Linux based router* as packet filtering is one defense against IP spoofing attacks. The Linux gateway to a network usually performs ingress filtering, which is blocking of packets from outside the network with a source address inside the network. This prevents an outside attacker spoofing the address of an internal machine. Ideally the Linux gateway would also perform egress filtering on outgoing packets, which is blocking of packets from inside the network with a source address that is not inside. This prevents an attacker within the network performing filtering from launching IP spoofing attacks against external machines.

I hope this will help someone.

Reply

11 Shoelaces November 5, 2011 at 3:35 am

I had to comment out:
$IPT -A OUTPUT -o $INT_IF -s $SERVER_IP -j $ACTION

this wouldn’t allow SSH connections out

Reply

12 Jouni "Rautamiekka" Järvinen August 6, 2012 at 1:07 pm

What about when the computer doesn’t have a LAN address, like those directly connected to Internet ?

Reply

13 Jouni "Rautamiekka" Järvinen August 6, 2012 at 2:20 pm

And why manually specify IPtables path when you can use §`which iptables`§ instead ?

Reply

14 shahzaib January 21, 2013 at 11:46 am

Hello,

Please if you can guide me about how can i identify if someone spoofing to my ip ? Which logs should i check ?

Reply

15 chadwick March 12, 2013 at 5:30 am

How do you “call this script from iptables”. What does that mean?

Reply

16 RealityBoy August 30, 2013 at 11:36 am

How do you “call this script from iptables”. What does that mean?

Reply

17 Bharath September 26, 2013 at 9:26 am

hi, my Linux Email Server(centos 5.7) is giving IP Address Spoofing in N/W.
am not running any proxy server in that. kept firewall off. now port 25 smtp is giving ip address spoofing with server’s public ip.

please advice.

Reply

Leave a Comment

Tagged as: , , , , , , , ,

Previous post:

Next post: