Why bother with specific ranges? Just block everything incoming, and only allow what you need.
This seems like a question worth exploring, a bit.
At first blush, it seems reasonable. Only let in the traffic you need! But a closer look at what's happening shows that antispoof rules probably serve a useful purpose.
Let's look closely at what this policy seems to do, in common practice, where we see rules like this offered up as industry common practice in tutorials, forums, and examples galore:
Code:
# example, over-simplified pf.conf
### deny all incoming traffic
block in all
### allow select ICMP for IPv4 and IPv6
pass in quick on $ext_if inet proto icmp icmp-type $ipv4_icmp_types
pass in quick on $ext_if inet6 proto ipv6-icmp icmp6-type $ipv6_icmp_types
### allow web clients to talk to the web server
pass in quick on $ext_if proto tcp from any to any port { 80, 443 } $tcp_state
pass in quick on $ext_if proto udp from any to any port 443 $udp_state
First, we block everything by default. So far, so good. The last-match pf processing seems to have our back, here, blocking all the spoofed packets!
Next, we allow traffic on the WAN interface in, if it matches certain ICMP types we allow, to be neighborly admins, and because they might be useful to us, from time to time.
Finally we allow traffic from the WAN interface to the web server, which is the raison d'être for our host. Also fine, and everything works!
But what happened to those spoofing attacks? Well, first we blocked them all. Party time!
Wait a second… our ruleset, like most pf rules we see in examples all over the Internet, allows in traffic
based on type and target port.
In practice, restricting access by source IP address seems to be an exceptional case, for example, if we're limiting a privileged set of admin users access to a VPN or ssh only from pre-approved locations.
Our example rules above only blocked spoofing attacks there were targeted at services (ports) we don't offer! We let the
IP Address Spoofing (Wikipedia) packets that were pretending to be ICMP or which were directed at our web server ports right on in! Oops!
So far, I remain of the impression that the easiest way to block most source-address spoofing attacks is to block the most common ones, which are pretending to be private networks, with a martian (aka bogon) rule.
I could possibly be talked out of this position, and it's entirely possible that I'm overlooking something, but the example explored above was selected specifically to be a fair representation of pf rules we commonly observe being recommended.
