Explain why an organizations firewall should block incoming

Explain why an organization\'s firewall should block incoming packets the destination address of which is the organization\'s broadcast address.

Solution

Answer:

Some IP addresses are specially designed by the IANA(Internet Assigned Numbers Authority) as reserved for internal network use only , not for internet use. The reserved address ranges are:

10.0.0.0 – 10.255.255.255

172.16.0.0 – 172.31.255.255

192.168.0.0 – 192.168.255.255

These addresses should never be seen over the internet. Sometimes the above addresses are used , this is caused by equipment which has been misconfigured , for example a firewall may accidentally be allowing internal addresses to leak onto the internet. Sometimes computers that unsuccessfully attempt to get a valid IP addresses through DHCP typically are assigned addresses on the 148.254 subnet. Another reason for seeing these addresses on the internet is that attackers are creating crafted packets with false IP addresses , this technique is called IP spoofing.

The main reason for performing IP spoofing is to make it harder for an attack to be traced back to its real IP address. Attackers may use addresses in the reserved address ranges listed in the above , more commonly , they use regular addresses which belong to someone else. Another type of IP spoofing attack is called Land attack, it uses packets with the source and destination address set to the same value. Packets should always have different source and destination addresses , so your network devices should reject any packets whose source and destination addresses are the same.

To protect network from IP spoofing generated by attackers on the internet or our own network , you should only permit incoming packets with a source address outside your network’s range , and outgoing packets with a source address in your network’s range. Packets that have a source or destination addresses in one of the ranges mentioned above should not be permitted through internet-based devices.    

For this reason an organization\'s firewall should block incoming packets the destination address of which is the organization\'s broadcast address.