Is it safe to restrict access to a site by IP?
I know there is something called "IP spoofing" - does this mean that (under some conditions) IP restriction is not accurate?
If a client forges its source IP address, it will be very difficult to establish a TCP connection, because as #cdhowie noted in a comment below, the client would need to ACK the server's SYN + ACK back, which it will never receive.
Spoofed IP addresses are mostly dangerous for denial of service attacks, as the attacker would not care about receiving responses to the attack packets, and they would be much more difficult to filter since each spoofed packet appears to come from a different address.
Not really. First, you would need to restrict all proxies, too, to be effective. More importantly, you may block legitimate users like this. It can be a quick-fix for some chronic issues, but in general it's not as effective as it seems.
IP Spoofing is mostly possible on LAN. In my opinion it is not possible to restrict access to site per IP. I would rather consider applying some certificates/auth methods.
Here is an example. Read some theory here
Related
nmap has a decoy option that can be used to give different ip addresses as source ip.
I was wondering how this works, as what i know packets are routed based on their source and destination ip address so when we send a packet with a different ip as source how does the answer gets back to us ?
Is this option works on a single broadcast domain or can it be used across the internet too?
Any link to a document or website about how this works will be great, thanks
I was also looking for the answer to this question. I thought of leaving what I found with a quick search.
how does the answer gets back to us ?
We are not interested in getting all the SYN,ACK replies back to us. We only need that one reply that comes back to the attacker's IP to figure out that the port is open. The primary purpose of the decoy is to confuse the IDS on the target site. If there are 10 different clients sending TCP SYN to the server, it wouldn't be easy to find who is the attacker, and who are the innocent clients.
Yes, the responses will be going back to the decoy addresses. That is why the following article says to make sure the decoy addresses are also alive because if they are not, the pattern of handshake will be different for the attacker and the dead decoy addresses, which the victim may be able to figure out and pinpoint the attacker's IP.
https://nmap.org/book/man-bypass-firewalls-ids.html
Is this option works on a single broadcast domain or can it be used
across the internet too?
I don't see any reason why it should be from the same subnet. It can be any IP address(es)
What I need is quite the same asked here, I don't understand the answer too well, because of my knowledge, so maybe someone could help me.
What I'd like to do is using the connected user's IP address (Client IP) to make the server-side HttpWebRequest, so I would grab the user's IP and make the call with it.
What I'd like to obtain is that every connected user makes HttpWebRequests with their IP.
Is it possible?
If it is, how should I edit that code to do this?
Thanks.
This is impossible. My answer to the other question was about selecting which IP Address (read: network adapter) to use for a request. However, you cannot invent IP Addresses out of thin air, nor use IP Addresses that are not yours (in a physical, attached-to-this-computer sense).
Now, technically, using Raw Sockets, you can spoof another IP Address in your packets. However, the problem with that is that the return traffic will go to the IP Address you specify, not the one you actually have!
So, my advice is to not pursue this line of thought any further, and find another way to do whatever it is that you are trying to do.
You may only make outbound connections from your server using an IP that is assigned to the server. If you tried to use a client's IP, it would fail.
Even if it did not fail, it would be a form of spoofing and would fail pretty qucikly anyway- the handshake that occurs using tcpip would case the remote connection to send an acknowledge packet back to the source ip (in your case, the client ip) which would result in an error.
If you are using UDP, it actually is possible to do this, but that is a different subject.
As an additional measure for securing a web application, I'm considering implementing client IP whitelisting.
The preferred way seems to be: do this at the router. However, this is a significant administrative burden in my scenario.
I would like to do this in software, on the web server. Is there a reason why this is less secure?
The HttpRequest.UserHostAddress is retrieved from the source ip number in the http request that is sent from the end user to your server. An http request is divided in several ip packets, and the source ip number is a field in each ip packet. Anyone on the net may craft ip packets with any ip number in the source field and send them to you.
However, the usefullness of this is somewhat restricted. When you respond to an http request, the response is sent to the source ip number in the request. The attacker will not recieve the response unless he is able to intercept the response on its way to the reciever. As an example: If the attacker send you a login request with a username and password, then you probably respond with a cookie. But since the cookie is sent to the fake source ip, the attacker will never see it.
IP spoofing is not technically difficult, but since the attacker will not recieve the response, it is mostly used for attacks that can be done with a single request.
Routers and firewalls may also protect you against malicious ip packets with false source ip's. Most firewalls will i.e. block packets from the external net with a source ip from the internal net.
Client IP whitelisting at the router level is done to keep traffic out of a network because you don't want hosts communicating with your servers if they aren't from the right neighborhood. This protects the servers from any number of OS-level attacks that only require access to the network stack.
What you are effectively talking about is using IP whitelisting as another factor for authentication on your server. It will not help you against a hacker that has the right attacks because unauthorized clients are still able to reach your server at the network stack level.
Both methods are susceptible to IP spoofing, and guarding against that is the responsibility of your network team. On a properly secured network you don't need to worry too much about malicious spoofing.
So, from a security standpoint it doesn't really hurt to use client IP whitelisting, but in the end, you're probably wasting your time maintaining the ACL. If you want to control which hosts can connect to your application to limit your security profile, a firewall or at least a router access list is the way to go.
Edit: An OS-level firewall is also a choice you should consider if routing & switching changes are too cumbersome for your situation.
In response to comment: A firewall whitelist would be more secure because it would be able to protect from OS-level attacks.
If you are not concerned with OS-level attacks then that part is not significant, and the end answer is yes, spoofing attacks are possible, and no, there is nothing you can do about it from within IIS or ASP.NET.
So I would still conclude that it is probably a waste of your time and the time of users who need to wait to be added to the whitelist. But from a security standpoint it probably won't hurt you and might keep some attackers from profiling your server as a soft target.
I would like to get the user's IP locally without any invoking any service.
Looking for a purely client side solution.
In general this problem is not solvable because the client computer might not even know its own external IP address. This happens when the client is behind a NAT or some other kind of firewall.
Note that many different client machines might share the same external IP address, and also different client machines might have the same internal IP address but different external IP addresses. Or, I can even imagine a situation where two different clients have the same internal and external IP addresses.
If you would explain why you believe you need this information, another solution to your actual problem might be possible.
Am I able to depend on a requestor's IP coming through on all web requests?
I have an asp.net application and I'd like to use the IP to identify unauthenticated visitors. I don't really care if the IP is unique as long as there is something there so that I don't get an empty value.
If not I guess I would have to handle the case where the value is empty.
Or is there a better identifier than IP?
You can get this from Request.ServerVariables["REMOTE_ADDR"].
It doesn't hurt to be defensive. If you're worried about some horrible error condition where this isn't set, check for that case and deal with it accordingly.
There could be many reasons for this value not to be useful. You may only get the address of the last hop, like a load balancer or SSL decoder on the local network. It might be an ISP proxy, or some company NAT firewall.
On that note, some proxies may provide the IP for which they're forwarding traffic in an additional HTTP header, accessible via
Request.ServerVariables["HTTP_X_FORWARDED_FOR"]. You might want to check this first, then fall back to Request.ServerVariables["REMOTE_ADDR"] or Request.UserHostAddress.
It's certainly not a bad idea to log these things for reference/auditing.
I believe that this value is set by your web sever and there is really no way to fake it as your response to there request wouldn't be able to get back to them if they set there IP to something else.
The only thing that you should worry about is proxies. Everyone from a proxy will get the same IP.
You'll always get an IP address, unless your web server is listening on some sort of network that is not an IP network. But the IP address won't necessarily be unique per user.
Well, web request is an http connection, which is a tcp connection and all tcp connections have two endpoints. So, it always exists. But that's about as much as you know about it. It's neither unique nor reliably accurate (with all the proxies and stuff).
Yes, every request must have an IP address, but as stated above, some ISP's use proxies, NAT or gateways which may not give you the individual's computer.
You can easily get this IP (in c#) with:
string IP = Context.Request.ServerVariables["REMOTE_ADDR"].ToString();
or in asp/vbscript with
IP = request.servervariables("REMOTE_ADDR")
IP address is not much use for identifying users. As mentioned already corporate proxies and other private networks can appear as a single IP address.
How are you authenticating users? Typically you would have them log in and then store that state in their session in your app.