hi guys. i was searching the forums about a very similar martian issue i'm having and i found this thread so i'm posting here...

my issue is with a simple slackware 9.1 gateway: iptables, dhcpd, dnsmasq, sshd, and squid (transparent)...

eth0 = (internet) 207.46.250.119

eth1 = (lan) 192.168.0.1


the martians in my logfile look like this:

i'm getting a few of those every now and then... notice that the source ip is that of my internet interface... yet the packet seems to be coming from the loopback interface??

i'm still not sure what to think here... any input is greatly appreciated...

=)

It's probably a spoofed packet. There are a number of possible ways these could be generated. If you could capture a few packets with tcpdump, it might be possible to identify why you're seeing them.

In general though, you should always have your firewall configured to log and drop these packets. This includes any of the IANA private or reserved IP addresses (like 192.168.X.X, 10.X.X.X) as these should never be coming into your external interface under normal conditions. Seeing them indicates either something is miss-configured or something malicious is occurring, so flat out dropping them or turning off the rp_filter are ill-advised.