topic Re: How to prevent IP spoofing from internet? in General Topics

How to prevent IP spoofing from internet?

Binoy — Fri, 25 Jun 2021 19:04:03 GMT

Can someone help me to understand how checkpoint firewall prevents IP spoofing from the internet?

Re: How to prevent IP spoofing from internet?

PhoneBoy — Fri, 25 Jun 2021 20:38:41 GMT

There's a couple things:

1. You define the topology on the gateway as to what's considered valid on the gateway for a given interface. In R80.20+ you can also let this be dynamically defined by the routing table.
2. We block the use of IP Options, which allows you to encode a route back to the IP.

Re: How to prevent IP spoofing from internet?

Cyber_Serge — Sat, 26 Jun 2021 01:48:06 GMT

you can also search " Anti-Spoofing" in the Security Gateway Administration Guide for your corresponding version to read up on more detail

Re: How to prevent IP spoofing from internet?

the_rock — Sat, 26 Jun 2021 11:49:23 GMT

I would refer to below link, it explains it very well:

https://sc1.checkpoint.com/documents/R80.20/SmartConsole_OLH/EN/html_frameset.htm?topic=documents/R80.20/SmartConsole_OLH/EN/ZvkmnUK_XluBBIIAw1mF3A2

@PhoneBoy gave you correct answer. Put it this way...there is an option on external interface to exempt any IP address, but you definitely do not want to turn off anti spoofing on external interface, thats a huge security issue. In some scenario, I seen people set it to "detect" on internal interface, but thats not as bad, since that would be used for outbound traffic anyway.

Re: How to prevent IP spoofing from internet?

Baasanjargal_Ts — Tue, 29 Jun 2021 06:59:21 GMT

If you activate IP spoofing on your interfaces, It will help to IP spoofing attacks. If attacker send a packet with the spoofed address into your servers It can prevent. For example, your Eth1 is configured 192.168.1.0/24 subnetting, then It will drop the packet if firewall receive this subnet IP come from another interface...

Re: How to prevent IP spoofing from internet?

Binoy — Tue, 29 Jun 2021 08:09:57 GMT

Thank you very much for the reply.

1. I understand that we can enable Anti-spoofing on interfaces based on the topology. Whether I need to enable anti-spoofing on Internet facing interface? As the default route is pointing to internet, how will it detect IP spoofing?

2. Whether IPS blade is required to block the IP Options. Could you please help to understand how to do it.

Re: How to prevent IP spoofing from internet?

PhoneBoy — Tue, 29 Jun 2021 20:38:20 GMT

For external interfaces, anything not defined on an internal interface would be considered invalid on the external interface.

IP Options checking is actually done in the firewall (not IPS) and done by default.
Modifying this behavior requires editing some .def files on the management and pushing policy.