Network plane hardening — anti-spoofing, bogon blocking, ICMP rate-limiting, and the perimeter · OPNsense

The network plane is the firewall’s first line of defence. The packets that arrive at the WAN interface are the packets the firewall has not yet processed; the rules that govern those packets are the rules that prevent spoofing, scanning, and denial-of-service from reaching the inside. A hardened data plane is necessary but not sufficient; an unhardened network plane exposes the data plane to traffic the rules were never meant to handle.

This lesson covers the network plane hardening checklist: anti-spoofing rules on the WAN, bogon and private-range blocking, ICMP rate-limiting, and the perimeter posture.

What the network plane is

The network plane is the boundary between the firewall and the outside. The WAN interface is the boundary; the LAN, OPT, and VLAN interfaces are the inside. The network plane hardening addresses the WAN-side traffic: packets arriving at the WAN interface, packets leaving the WAN interface, the types of traffic the WAN interface should accept.

The hardening is bidirectional. The WAN interface must drop packets that should never arrive (spoofed sources, bogons) and must shape packets that should never leave (source addresses that should not appear in outbound traffic).

Read-only / SafeCapture inbound traffic with RFC1918 sources— A capture on the WAN interface that excludes the legitimate source shows RFC1918 sources (10.0.0.1, 192.168.1.1, 172.16.0.1) and loopback (127.0.0.1). These sources should never appear on the WAN interface — they are either spoofed or misrouted. The hardening review catches this with a baseline capture; the operator adds anti-spoofing rules that drop the traffic before it reaches the data plane.

$ tcpdump -ni igb1 -c 50 'not src host 203.0.113.1' 2>&1 | head -20

12:34:56.789012 aa:bb:cc:11:22:33 > 66:77:88:99:aa:bb, IPv4, length 64: 10.0.0.1.54321 > 203.0.113.50.443: Flags [S], seq 12345
12:34:56.789345 aa:bb:cc:11:22:33 > 66:77:88:99:aa:bb, IPv4, length 64: 192.168.1.1.54321 > 203.0.113.50.443: Flags [S], seq 12346
12:34:56.789678 aa:bb:cc:11:22:33 > 66:77:88:99:aa:bb, IPv4, length 64: 172.16.0.1.54321 > 203.0.113.50.443: Flags [S], seq 12347
12:34:56.790012 aa:bb:cc:11:22:33 > 66:77:88:99:aa:bb, IPv4, length 64: 127.0.0.1.54321 > 203.0.113.50.443: Flags [S], seq 12348

Illustrative output

Anti-spoofing on the WAN

Anti-spoofing is the discipline of dropping packets whose source addresses should never arrive at the WAN interface. The canonical sources to drop:

RFC1918 ranges. 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. These are private; they should never appear on a public WAN interface.
Loopback. 127.0.0.0/8. Loopback should never leave a host, let alone arrive at a WAN interface.
Link-local. 169.254.0.0/16. Link-local is for local segment only; it should not traverse a router.
Documentation ranges. 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24. These are reserved for documentation; their appearance in production traffic is suspicious.
Multicast and broadcast sources. Source addresses in 224.0.0.0/4 and the broadcast address 255.255.255.255. These should never be sources.

The control is a block rule at the top of the WAN ruleset that drops any packet whose source matches these ranges. OPNsense ships with aliases for these ranges (RFC1918, Loopback, LinkLocal, etc.); the rule uses the aliases.

The threats addressed: spoofed sources used to bypass source-restricted rules, lateral movement where an attacker injects traffic with an internal source address, scanner probes that test whether the firewall accepts spoofed sources.

The evidence produced: the rule in pfctl -s rules, the log entries showing dropped packets, the periodic capture that confirms spoofed sources are still being dropped.

Bogon blocking

Bogons are IP address ranges that are not allocated to any autonomous system on the public Internet. They include:

Reserved ranges. Address space reserved by IANA for future use.
Unallocated ranges. Address space that has not been assigned to a Regional Internet Registry.
Deallocated ranges. Address space that was once allocated but has been returned.

The bogon list changes as IANA allocates and deallocates address space. The list is updated regularly; the operator refreshes the bogon list on OPNsense’s schedule (default: weekly).

The control is similar to anti-spoofing but covers the unallocated ranges that anti-spoofing does not. The combined control (RFC1918 + bogons) drops all traffic that should never appear at the WAN interface.

The threats addressed: traffic from compromised hosts using bogus sources to hide their origin, scanner probes using bogon sources to evade detection, accidental routing leaks that send internal traffic out the WAN interface.

The evidence produced: the bogon list update logs, the rule in pfctl -s rules, the log entries showing dropped packets.

ICMP rate-limiting

ICMP is more than ping. ICMP carries Path MTU Discovery (type 3 code 4), traceroute (type 11), and other necessary functions. Dropping all ICMP breaks these functions. Rate-limiting ICMP keeps the functions and limits the abuse.

The control has three parts:

Allow necessary ICMP types. Type 3 code 4 (fragmentation needed), type 11 (time exceeded), type 8/0 (echo request/reply) for diagnostic purposes. These are allowed with rate limits.
Drop the rest. ICMP types that have no legitimate use (type 5 redirect, type 4 source quench, etc.) are dropped.
Apply rate limits. Each allowed ICMP type is rate-limited to a reasonable volume (e.g., 100 echo requests per second per source).

The threats addressed: ICMP-based DoS (ping floods, smurf attacks), ICMP-based reconnaissance (ICMP echo sweeps, ICMP timestamp requests), ICMP-based lateral movement (ICMP redirect attacks).

The evidence produced: the rate-limited rules in pfctl -s rules, the ICMP counters showing drops and accepts, the absence of broken Path MTU Discovery in TCP flows.

Outbound source-address verification

Anti-spoofing addresses inbound traffic. Outbound source-address verification addresses outbound traffic: packets leaving the firewall (or any host behind the firewall) should have a source address that matches the interface they are leaving on.

The control: a rule that drops packets leaving the WAN interface whose source address is not the WAN IP. The rule catches:

Misconfigured hosts behind the firewall using the wrong source address.
Spoofed traffic generated from inside the firewall.
Compromised hosts attempting to use the firewall as a launchpad.

The threats addressed: outbound spoofing (an attacker uses the firewall to send traffic with a spoofed source), accidental routing (a misconfigured host sends traffic with the wrong source), compromised hosts using the firewall as a relay.

The evidence produced: the rule in pfctl -s rules, the log entries showing dropped packets with mismatched sources.

The perimeter posture

The network plane hardening is the perimeter posture. The perimeter posture is the firewall’s overall posture at the WAN boundary:

Default deny. The WAN interface has no implicit allow rules. Every inbound packet must match an explicit rule.
Stateful filtering. PF creates state for outbound connections; inbound packets must match an established state or an explicit allow rule.
Rate-limited ICMP. ICMP is allowed with rate limits, not dropped.
Anti-spoofing. Spoofed sources are dropped at the top of the WAN ruleset.
Bogon blocking. Unallocated sources are dropped.
Source address verification. Outbound packets with wrong sources are dropped.

A firewall with all six controls has a hardened network plane. A firewall missing one or more has a network plane that an attacker can use as a foothold.

How PF's state table interacts with anti-spoofing

Anti-spoofing rules operate on individual packets, not on flows. Each packet that arrives at the WAN interface is checked: is the source address in the anti-spoofing list? If yes, the packet is dropped; PF never creates state for it.

The implication is that anti-spoofing drops spoofed packets before state is created. The state table only contains entries for legitimate flows. An attacker who sends spoofed packets cannot fill the state table with garbage; the packets are dropped before they consume state-table entries.

The second implication is that anti-spoofing rules must be evaluated before state-matching rules. PF’s evaluation order matters: a spoofed packet that matches an established state (because the attacker guessed the four-tuple) is dropped by the anti-spoofing rule before the state-matching rule is consulted.

Summary

Anti-spoofing on the WAN: drop RFC1918, loopback, link-local, documentation, and multicast sources.
Bogon blocking: drop unallocated and deallocated address space. Refresh the bogon list regularly.
ICMP rate-limiting: allow necessary types (PMTUD, traceroute, echo) with rate limits; drop the rest.
Outbound source-address verification: drop packets leaving the WAN whose source is not the WAN IP.
The perimeter posture: default deny, stateful filtering, rate-limited ICMP, anti-spoofing, bogon blocking, source address verification.