Can ipopts be used to circumvent a pf or iptables firewall source IP based blocking?

Question

Can one use ipopts, and in particular IP source routing, to circumvent source-based blocking in pf or iptables?

For example, with OpenBSD's pf:

block in  all # default deny
block out all
pass in  on dc0 from 10.0.0.0/8 to 10.1.1.1

Can IP source routing of TCP/IP packets over dc0 be used to circumnavigate (so to speak) the firewall rules and communicate with 10.1.1.1 from a network other than 10/8?

Even if possible, is such circumnavigation a viable or plausible attack if dc0 is public-facing? If so, can this be prevented?

Do you mean using dc0 on the same machine as the pf or iptables? — this.josh, Jun 27 '11 at 05:17
@this.josh: Yes exactly, *dc0* on the same machine as the firewall. — Brian M. Hunt, Jun 28 '11 at 13:39

D.W. · Answer 1 · 2011-06-27T06:55:43.590

2

I don't know specifically whether it can bypass these particular firewalls, but my superficial impression is that most firewalls block source routing, specifically because of these kinds of threats.

edited Jun 27 '11 at 06:55

answered Jun 26 '11 at 02:53

D.W.

98,420
30
267
572

What do you mean by "disable"? Reject ingress packets that have any source routing? – Brian M. Hunt Jun 26 '11 at 20:23
@Brian, yes, exactly. Thank you for helping me clarify. – D.W. Jun 27 '11 at 06:56

score 2 · Accepted Answer · answered Jun 29 '11 at 07:40

For incoming packets, packet filtering (call to pf_test on line 367) is done before option processing (call to ip_dooptions on line 384) in ip_input.c

For outgoing packets, routing (starting on line 170) is done before packet filtering (call to pf_test on line 691) in ip_output.c

So, if the packet filtering is working correctly, then no, source routing will not circumvent the firewall, because for incoming packets source routing is not applied until after filtering, and for outgoing packets filtering is done after source routing is applied.

Can ipopts be used to circumvent a pf or iptables firewall source IP based blocking?

2 Answers2