Personally, I use the configuration script listed below on my internet-facing interface. This guarantees that all packets coming into my net are tagged with a source address OUTSIDE my net, and are bound for a host inside my net. Likewise, outbound packets MUST have an origin inside my net. This protects me from address spoofing from the rest of the net, and protects the rest of the net from my users. I've got similar filters on all of my customer-facing interfaces. -forrestc@imach.com -- Start of Included File -- ! ! Configuration Script for IP Filtering on Internet-facing interface ! 101 is inbound ! 102 is outbound ! int s 0 no ip access-group 101 in no ip access-group 102 out exit no access-list 101 access-list 101 deny ip 204.94.230.0 0.0.1.255 any access-list 101 deny ip 204.182.240.0 0.0.15.255 any access-list 101 deny ip 199.5.171.0 0.0.0.255 any access-list 101 deny ip 199.5.172.0 0.0.0.255 any access-list 101 deny ip 205.166.211.0 0.0.0.255 any access-list 101 deny ip 206.127.64.0 0.0.63.255 any access-list 101 deny ip 206.58.180.0 0.0.1.255 any access-list 101 deny ip 206.58.182.0 0.0.0.255 any access-list 101 permit ip any 204.94.230.0 0.0.1.255 access-list 101 permit ip any 204.182.240.0 0.0.15.255 access-list 101 permit ip any 199.5.171.0 0.0.0.255 access-list 101 permit ip any 199.5.172.0 0.0.0.255 access-list 101 permit ip any 205.166.211.0 0.0.0.255 access-list 101 permit ip any 206.127.64.0 0.0.63.255 access-list 101 permit ip any 206.58.180.0 0.0.1.255 access-list 101 permit ip any 206.58.182.0 0.0.0.255 no access-list 102 access-list 102 permit ip 204.94.230.0 0.0.1.255 any access-list 102 permit ip 204.182.240.0 0.0.15.255 any access-list 102 permit ip 199.5.171.0 0.0.0.255 any access-list 102 permit ip 199.5.172.0 0.0.0.255 any access-list 102 permit ip 205.166.211.0 0.0.0.255 any access-list 102 permit ip 206.127.64.0 0.0.63.255 any access-list 102 permit ip 206.58.180.0 0.0.1.255 any access-list 102 permit ip 206.58.182.0 0.0.0.255 any int s 0 ip access-group 101 in ip access-group 102 out exit -- End of Included File ---