Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm currently developing software which requires various remote sites to securely connect to our servers to access a basic webapp.

Up until now, I've been working on a client/server VPN setup - it's certainly very secure, but there's a lot of difficulty involved with windows/linux connections, routing among client computers, and the need for extra client servers/hardware etc.

I'm now thinking that allowing SSL web access with a username/password would be acceptable if it was strictly restricted to authorized IP ranges - I would assume this setup wouldn't be secure, with ip spoofing etc, but I can't find anyone warning against it.

My question is how secure would this be? Is it possible for someone to spoof the client IP and manage to connect anyway? How would this compare to a VPN?

share|improve this question

closed as off topic by Lucas Kauffman, Ladadadada, Bart De Vos, sam, Ward Mar 15 '12 at 18:58

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Are those voting to close suggesting this is better on IT Security (security.stackexchange.com)? –  dunxd Mar 15 '12 at 12:17
    
Related topics are being discussed over on Security.SE now. security.stackexchange.com/questions/12729/… and security.stackexchange.com/questions/12701/… –  Ladadadada Mar 15 '12 at 12:18

4 Answers 4

up vote 8 down vote accepted

IP spoofing to authenticate to a network is not an easy task, but it can be done. Most IP spoofing attacks just want to conceal their identity because they don't care about getting an answer(DDoS). To succeed in SSL handshaking you will need to be able to intercept all the packets for the IP you are spoofing, because you need to answer them. It can be done but it's extremely difficult as you would need access to certain routers or be on the same subnet as the IP you are pretending to be.

Since you are also adding an authentication mechanism, I don't think it will be easy to attack it. Just keep track of login attempts and implement some tressholds so you can block off an ip after so many attacks (and a notification mechanism), and you will be alright.

share|improve this answer

An attack based on IP spoofing would be highly targeted, so the level of risk is probably related to how valuable a successful attack would be.

I think it is a good defence against probing attacks, and combined with a secure authentication mechanism would be effective. If you can achieve everything you need with an https interface, then it is probably good enough.

share|improve this answer

Limiting per-IP should be considered pretty secure as long as your traffic transmission is also secure, you should be using SSL. If the information is extra sensitive you could look in to client-side SSL certificates to confirm user access too.

share|improve this answer

I would assume this setup wouldn't be secure, with ip spoofing etc,

You cannot spoof IP addresses.

Or: you can fake the return IP, but then you can never establish a connection.

This is like saying you want to have someone call you back but you give them the wrong phone number. They can call you back, but never reach you.

Is it possible for someone to spoof the client IP and manage to connect anyway?

No. They can start establishing a connection, which then gets stuck in half open state - as they don't get the return packets from the server. This is a known (old but not longer really applicable thanks to syn-cookies) denial of service attack (servers could not handle hundreds of thousands of half open TCP connections). But they can never establish full communication without having access to the source IP via routing.

share|improve this answer
    
If the attacker controls a node on the return path to an IP they can spoof the IP; MITM style. But otherwise you are correct that it's not possible. –  Chris S Mar 15 '12 at 12:59
    
MTM is not really spoofing, though. You are right, this isa problem - but it is not something "typical". –  TomTom Mar 15 '12 at 13:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.