0

RFC 2827 describes the idea of ingress filtering that is meant to deal with DOS attacks that utilize IP spoofing:

An input traffic filter on the ingress (input) link of "router 2", which provides connectivity to the attacker's network, restricts traffic to allow only traffic originating from source addresses within the 204.69.207.0/24 prefix, and prohibits an attacker from using "invalid" source addresses which reside outside of this prefix range.

Is such filtering implemented in every router that firmware such as openWRT supports? Would anybody be so kind and provide me with a relevant snippet of code that provides for such filtering. Was there ever a documented case of an attack that utilized IP spoofing along with a tweak in the firmware of the attacker's router that allowed for the lack of said filtering.

1

1 Answer 1

2

Is such filtering implemented in every router that firmware such as openWRT supports?

Not every router supports ACLs. Many do, and to filter by source address a simple ACL is enough. You don't have to support stateful filtering, so it's cheap to implement. But there's no inherent requirement in IP that routers supports filtering.

As Drop traffic is commonly the default policy for a firewall, this can be achieved simply with a permit matching the desired source addresses. Traffic not matching that rule will be dropped by default policy if that is drop.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .