8

I run a small business that handles credit card point of sales transactions over my business internet account.

Per some updated regulations with the credit processing company, they now have a requirement that the hardware used at my business be protected against certain attacks.

Here is the specific requirement:

"Implement anti-spoofing measures to detect and block forged source IP addresses from entering the network (1.3.4): In an attempt to bypass your firewall, cyber attackers will try and spoof packets using the internal IP range of your network to make it look like the request originated internally. Enabling the IP spoofing feature on your firewall will help prevent these types of attacks."

I am currently using a Linksys BEFSX41 network router, which has a firmware based firewall. However, I am having trouble determining if an "IP spoofing feature" is already part of the Linksys firmware or if I need to purchase a new router for this capability. My research so far shows that there are certain enterprise-level Cisco devices that explicitly mention this feature, but they seem to be outside of my price range.

What models exist that have this feature and are more reasonably priced than enterprise-grade equipment?

The network at my business is a couple of workstations, some network attached storage, a printer, and some point of sale devices. DHCP is enabled on the router firmware.

Please let me know if I can provide any additional information. I'm a bit naive in this area of computing.

Improve this question
1
  • 1
    What you need is simply a firewall with the ability to block packets based on ranges of "source" or "destination" addresses. Unfortunately, the firewall on your current device is too primitive to do this. You don't need an enterprise-grade device from Cisco; a high-end consumer-grade device is likely to support it, or if you're willing to install the OpenWRT firmware, you can get something even cheaper. – Mark Mar 19 '16 at 18:06
0

What you need is a firewall that that does packet inspection so that it can prevent IP spoofing.

Your Linksys BEFSX41 (assuming v2) "does" packet inspection and can prevent IP Spoofing (see data sheet). That said, this router/firewall is from 2004 (over 12 years old) and as far as I can tell, there have been no updates to this particular model; meaning it isn't current to address current threats.

enter image description here

I recommend pfSense.

The beauty with this platform is that you can purchase a complete hardware appliance for as little as $300 or your can build your own if you have a spare PC laying around. There are videos on YouTube that show you how you can do this.

Packet normalization - Description from the pf scrub documentation - "'Scrubbing' is the normalization of packets so there are no ambiguities in interpretation by the ultimate destination of the packet. The scrub directive also reassembles fragmented packets, protecting some operating systems from some forms of attack, and drops TCP packets that have invalid flag combinations."

Being a small business, I can appreciate trying to maximize your investment and getting the most value for a dollar. I have recommended pfSense to many of my clients and I use it personally at both my office and at home. I think you will find it more than capable to meet your needs.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy