The IP address of the wireless route solves "spoofing"

There are many things worth learning about configuring wireless Route IP addresses. Here we mainly introduce the detailed knowledge about using access control lists in wireless Route IP addresses. In the typical wireless Route IP Address Spoofing, attackers usually forge the packet Sending address so that they can look like they are from the Intranet. Here we will tell you the three methods that can be taken to make the attacker's days less favorable, so that IP address spoofing cannot be easily achieved.

As we all know, security risks are everywhere on the Internet, one of which is the spoofing of the wireless Route IP address. In typical IP Address Spoofing, attackers generally forge the sending Address of data packets so that they look like they are from the Intranet. The following describes three methods to protect enterprises from such attacks.

Blocked IP Address

The first trick to prevent IP spoofing during the IP period is to prevent IP addresses that may cause risks. No matter what the cause is, attackers can impersonate any IP address. The most common IP addresses are private IP addresses and other types of shared/Special IP addresses. Here are some lists of wireless Route IP addresses and Their subnet masks that will prevent them from accessing my network from the Internet.

10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
127.0.0.0/8
224.0.0.0/3
169.254.0.0/16

All the above addresses are either private network wireless Route IP addresses that are not routable on the Internet, or IP addresses that are used for other purposes and should not be on the Internet. If the incoming data from the Internet is marked with these IP addresses, it is undoubtedly a lie. In addition, some other frequently counterfeited IP addresses are any Intranet IP addresses used by your enterprise. If you use all the private IP addresses, the IP address ranges you want to block will fall into the list above. However, if you are using a group of public IP addresses, then you should add them to the above list.

Use the access control list (ACLS)

The simplest way to prevent IP spoofing is to use inbound filtering for all Internet data. Filter all data packets that fall into the preceding Wireless IP address. In other words, you can create an access control list to remove all inbound data from IP addresses in the preceding range. Here is a configuration example:

Router # conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router (config) # ip access-list ext ingress-antispoof
Router (config-ext-nacl) # deny ip 10.0.0.0 0.20.255.255 any
Router (config-ext-nacl) # deny ip 172.16.0.0 0.15.255.255 any
Router (config-ext-nacl) # deny ip 192.168.0.0 0.0.255.255 any
Router (config-ext-nacl) # deny ip 127.0.0.0 0.20.255.255 any
Router (config-ext-nacl) # deny ip 224.0.0.0 31.20.255 any
Router (config-ext-nacl) # deny ip 169.254.0.0 0.0.255.255 any
Router (config-ext-nacl) # permit ip any
Router (config-ext-nacl) # exit
Router (config) # int s0/0
Router (config-if) # ip access-group ingress-antispoof in