Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How does antispoof in pfSense work?

    Scheduled Pinned Locked Moved Firewalling
    23 Posts 6 Posters 3.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • jimpJ
      jimp Rebel Alliance Developer Netgate
      last edited by

      The defaults can't stop you from hurting yourself. No matter how they are set, there will be some way to misuse them or break things. The burden is on the user to choose appropriate options.

      /24 is a worse default for interfaces than /32. With /32, everyone has to change the mask and it's safely broken (not going to hurt any other networks), whereas /24 could harm any number of misconfigured WANs.

      any as a default source is the most eye-catching default. Anyone who sees that should want to fix it. If we defaulted to something else, it could break in other ways. Not every interface has an address, thus doesn't have an interface network, so using that would not work on such interfaces.

      Sure there is a lot of subjectivity here but ultimately the burden is on the end user to know what they are doing.

      @apollo13 said in How does antispoof in pfSense work?:

      Now everyone on em0 & em1 can access SOME_HOST. So far so good, but the result of that rule is also than anyone on em0 can use a spoofed IP from em1 to access that host (actually any address), which is what I am trying to prevent.

      That example isn't valid, though. If the user spoofed the address in that scenario, it would either never leave the network or never get a reply. They couldn't access anything. At most they'd get a single packet to the destination, so it's more of a concern for attacks that may only have a single packet payload or need no response.

      By not using quick we give the user the option to override the antispoof behavior. If we changed them to quick then odds are we'd break thousands of networks out there that rely on being able to manually manage that behavior.

      Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

      Need help fast? Netgate Global Support!

      Do not Chat/PM for help!

      johnpozJ A 2 Replies Last reply Reply Quote 2
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @jimp
        last edited by johnpoz

        @jimp said in How does antispoof in pfSense work?:

        Sure there is a lot of subjectivity here but ultimately the burden is on the end user to know what they are doing.

        Completely and wholeheartedly agree with this! ;)

        @jimp so could you give an example of when the antispoof actually comes into play for sake of completeness.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • A
          apollo13 @jimp
          last edited by

          Ok, thank you for clearing up the rationale behind those defaults. I do agree with most of them. I guess what threw me off was that https://docs.netgate.com/pfsense/en/latest/firewall/firewall-rule-processing-order.html#longer-version has "Internal automatic rules (pass and block for various items like lockout, snort, DHCP, etc.)" before "User-defined rules" and I assume antispoof was such an internal automatic rule.

          @jimp said in How does antispoof in pfSense work?:

          @apollo13 said in How does antispoof in pfSense work?:

          Now everyone on em0 & em1 can access SOME_HOST. So far so good, but the result of that rule is also than anyone on em0 can use a spoofed IP from em1 to access that host (actually any address), which is what I am trying to prevent.

          That example isn't valid, though. If the user spoofed the address in that scenario, it would either never leave the network or never get a reply. They couldn't access anything. At most they'd get a single packet to the destination, so it's more of a concern for attacks that may only have a single packet payload or need no response.

          Okay, this is where my network knowledge appears to be lacking. In which cases wouldn't it leave the network? Is it because the return-path would make no sense for pfSense or something else?

          And couldn't it be used for instance to send a DNS response to the spoofed address? Or with any other UDP protocol to generate amplification.

          I understand that the last questions are most likely not realistic attack scenarios after all, but the answer to those would help me widen my understanding of how all of this works. So while the question might be naive, I'd appreciate if you find the time to give me a few more pointers.

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            If a client connected to em0 manually sets an IP from em1 and you have rules to pass that that bypass the antispoof rules as discussed they should not have any connectivity.
            What do they set as their gateway IP? If they set the em0 IP that's outside their subnet (probably). If they set the em1 IP they would ARP for it and it would not reply as it's in a different subnet.
            But even if it did and they managed to send traffic any replies would be sent back out of em1. If in fact it left at all since the client would not respond to ARPs from em1 as it's not connected there.

            Interesting question though. I normally try to avoid that sort of thing! 😉 I don't think I've ever tested how it fails exactly.

            Steve

            A 1 Reply Last reply Reply Quote 0
            • A
              apollo13 @stephenw10
              last edited by

              @stephenw10 said in How does antispoof in pfSense work?:

              If a client connected to em0 manually sets an IP from em1 and you have rules to pass that that bypass the antispoof rules as discussed they should not have any connectivity.

              Sure, there would be no (full) connectivity. But I am more thinking about malicious users here, not legitimate users.

              But even if it did and they managed to send traffic any replies would be sent back out of em1. If in fact it left at all since the client would not respond to ARPs from em1 as it's not connected there.

              Right, but an answer sent back to em1 could be considered kind of an attack (DNS amplification attacks etc come to mind?)

              Interesting question though. I normally try to avoid that sort of thing! 😉

              Hehe, me to. I was tightening firewall rules and looked at the generated rules.debug and started wondering…

              Thank you all for your insights, it was fun to dig through the rules and I guess I learned something on the way.

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                I would still like to see a when would this really "make sense" and do what it suppose to do, etc. as an example.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • A
                  apollo13
                  last edited by

                  Well, I cannot see any legitimate or useful use case myself aside from launching attacks against the network :)

                  P 1 Reply Last reply Reply Quote 0
                  • P phil80 referenced this topic on
                  • P
                    phil80 @apollo13
                    last edited by

                    This thread was really helpful and the flexibility that pfsense gives here is amazing

                    However, it should have been better documented in the docs, in anti spoofing section

                    Is it worth a commit to propose a change in the docs?

                    Here's a somehow atypical use of this specificity in the anti spoofing rule:
                    https://forum.netgate.com/topic/163088/l3-switch-and-pfsense-design-advise/16?_=1641114477363

                    1 Reply Last reply Reply Quote 0
                    • M
                      mer
                      last edited by

                      @apollo13 said in How does antispoof in pfSense work?:

                      Therefor antispoff will match after any user defined rules by default if I understand it correctly.

                      Doesn't it depend on where the antispoof rules are in the ruleset? I'm looking at the expanded rules and it looks like the expanded antispoof rules are above my userrules anchor. Since they don't have a quick on the antispoof, but are physically above userrules, shouldn't it get evaluated first but not acted on unless there is no other rule matching the packet? The "last match wins" behavior?

                      Everything else said in this thread is the behavior I've seen; it's just that specific statement I think is not quite correct.
                      If I'm wrong, please correct me.

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Yes, exactly that. I think that statement was intended to imply the same; the antispoof rules match traffic before the user rules but without 'quick' set their action is not applied until after the user rules. Therefore it's possible to by-pass the antispoof rules with an excessively wide user rule.
                        Pass rules should use actual subnet(s) they apply to as source where possible.
                        The Interface group example above is an interesting one though.

                        Steve

                        1 Reply Last reply Reply Quote 1
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.