IP spoofing protection
U
SER
G
UIDE
194
IP
SPOOFING PROTECTION
Spoofing is a type of attack that uses the forgery of the IP source address.
It is possible to make the router reject packets when their source interface is different from the one
to which the answering packets will be forwarded. This technique is called
Reverse Path Filtering
.
Here an example: on eth0 the router has IP 10.10.113.1/16, on eth1 the router has IP address
11.11.113.1/16; a packet received on eth0 with IP 11.11.113.2 will be rejected.
The command to enable the spoofing protection is:
set <ifname> reverse-path-filter
where
<ifname>
can be one of the interfaces below:
set ethX reverse-path-filter
set vlan ethX.N reverse-path-filter
set bridge br br0 reverse-path-filter
set gre tunnel X reverse-path-filter
If you need to disable the antispoofing protection, the command is:
set <ifname> no-reverse-path-filter
applying the command you will have, for example:
set eth0 no-reverse-path-filter
If you want to have a log of the “spoofed” packets, use:
set <ifname> log-martians
example:
set eth0 reverse-path-filter
set eth0 log-martians
See the example below, where the packets are received on eth0 from the IP 11.11.113.2 and
headed to 8.8.8.8
martian source 8.8.8.8 from 11.11.113.2 , on dev eth0
