Let's suppose that I have 2 ipvlan mode l2 network interfaces: A and B, and A is in a network namespace.

  1. When B receives a packet, is it possible to distinguish in a netfilter (iptables) rule whether the packet has come from the same host (i.e. from A), without hardcoding the IP address of A?

  2. Is it possible for a malicious host on the local network to do some ARP attack, and take over the IP address of A, thus when B receives a packet from the IP address of A, the packet may come from the malicious host?

I need this for setting up netfilter rules to allow traffic from A to B (port X), but to disallow traffic from other hosts on the local network to B (same port X). Thus I want to distinguish A from other hosts on the local network.

  • 1
    Using an injection tool (packit) from a 3rd namespace with an ipvlan interface, it looks I was able to spoof A (so I removed my previous comment). – A.B Dec 16 '20 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.