Skip to main content
Commerce Security Authority
Category: Network Security

Ingress Filtering

Simply put

Ingress filtering is a security practice that monitors and controls traffic coming into a network, allowing only legitimate traffic to pass while blocking suspicious or unauthorized packets. One common goal is to verify that incoming packets genuinely come from the source networks they claim to originate from. This helps reduce certain attacks, such as those relying on spoofed source addresses.

Formal definition

Ingress filtering is a technique for monitoring, controlling, and restricting inbound traffic at a network boundary so that only legitimate packets are permitted to enter. A core application is verifying that incoming packets actually originate from the networks they claim as their source, which helps mitigate source-address spoofing and can reduce the effectiveness of certain spoofed-source attacks. It is typically implemented on routers, firewalls, or switch ports (for example, VLAN ingress filtering) and is complementary to egress filtering, which restricts outbound traffic. Ingress filtering is intended to reduce, not eliminate, unauthorized or malicious traffic, and its effectiveness depends on correct configuration and placement relative to the traffic being controlled.

Why it matters

Ingress filtering addresses a foundational weakness in IP networking: packets can carry a forged source address that does not reflect where they truly originated. By verifying at a network boundary that inbound packets genuinely come from the source networks they claim, ingress filtering helps reduce source-address spoofing, which is a technique used in certain classes of attacks. In a payment environment, where network boundaries separate cardholder data environments from less trusted networks, controlling what traffic is permitted to enter is a core part of a defense-in-depth posture.

For teams responsible for network security, ingress filtering is best understood as one layer among several rather than a standalone safeguard. It is intended to reduce, not eliminate, unauthorized or malicious traffic, and its effectiveness depends heavily on correct configuration and appropriate placement relative to the traffic being controlled. A filter applied at the wrong boundary, or one with overly permissive rules, may pass traffic that it was intended to block, so the control should be validated in practice rather than assumed to work from its label alone.

Ingress filtering is complementary to egress filtering, which restricts outbound traffic, and the two are often deployed together to control both directions of flow at a boundary. Because spoofing-based attacks and their mitigations evolve, ingress filtering should be reviewed alongside other network controls rather than treated as a fixed, one-time setting.

Who it's relevant to

Network Security Engineers
Engineers configuring routers, firewalls, and switch ports use ingress filtering to permit only legitimate inbound traffic and to reject packets with source addresses inconsistent with the networks they claim. Correct placement and rule maintenance are essential, since a misplaced or overly permissive filter may fail to block the traffic it was intended to stop.
Compliance and Segmentation Teams
Teams responsible for maintaining boundaries around sensitive network segments can use ingress filtering, alongside egress filtering, as part of controlling traffic entering a trusted zone. Because its effect depends on implementation and placement rather than on the label alone, these controls should be validated in practice and documented against the applicable requirements in the current published standard.
Fraud and Threat Analysts
Analysts assessing network-borne threats should understand that ingress filtering helps reduce the effectiveness of certain spoofed-source attacks but does not eliminate malicious traffic. It is one layer of a broader defense-in-depth approach and should be considered together with other detection and prevention controls.

Inside Ingress Filtering

Source Address Validation
The core function of ingress filtering, in which inbound traffic entering a network is examined to confirm that its source IP address is plausible and consistent with expected routing. Traffic bearing spoofed or otherwise implausible source addresses can be dropped at the boundary.
Network Boundary Enforcement Point
The device or location, typically a border router or firewall, where ingress filtering rules are applied to traffic arriving from an external or less-trusted network. In a PCI DSS context, boundary controls between untrusted networks and the cardholder data environment are relevant to network segmentation and traffic restriction requirements; confirm exact requirement wording against the current published standard.
Filtering Ruleset / ACLs
The access control lists or filter policies that define which inbound traffic is permitted or denied based on attributes such as source address ranges, destination, and protocol. These rules must be maintained and reviewed as network topology changes.
Anti-Spoofing Objective
The intent to reduce the effectiveness of IP source address spoofing, which is often associated with certain denial-of-service and reflection techniques. Ingress filtering is intended to help limit spoofed traffic reaching internal systems, not to address all attack categories.
Relationship to Egress Filtering
Ingress filtering governs traffic entering a network, while egress filtering governs traffic leaving it. The two are complementary boundary controls; effective address-spoofing mitigation across the Internet depends on many networks applying such controls.

Common questions

Answers to the questions practitioners most commonly ask about Ingress Filtering.

Does ingress filtering by itself stop external attackers from reaching internal systems?
No. Ingress filtering is intended to control and inspect traffic entering a network from external or less-trusted sources, and it can help reduce exposure of internal systems, but it is one control among many. It does not by itself stop attackers, particularly against traffic that appears legitimate, uses permitted ports and protocols, or originates from compromised trusted sources. It should be combined with other controls such as egress filtering, segmentation, monitoring, and access controls. Treating any single control as sufficient overstates its effect.
Is ingress filtering the same thing as anti-spoofing, and does it prevent spoofed source addresses?
They overlap but are not identical. Ingress filtering commonly includes anti-spoofing measures, such as rejecting inbound packets whose source addresses claim to originate from internal or reserved address ranges, which may mitigate certain spoofing-based attacks. However, ingress filtering more broadly refers to controlling what traffic is permitted to enter a network boundary, of which anti-spoofing is one application. Anti-spoofing at ingress helps reduce specific classes of spoofing but does not eliminate all spoofing techniques or address threats that do not rely on forged source addresses.
How does ingress filtering relate to defining and protecting a PCI DSS cardholder data environment?
Ingress filtering is typically applied at the boundaries of a network segment to restrict inbound traffic to only what is necessary. When used to control traffic entering a cardholder data environment, it can support the network security and segmentation objectives described in PCI DSS. Requirement numbering and wording differ between PCI DSS versions, so confirm the applicable requirements against the current published standard. The effectiveness of ingress filtering for scope reduction depends on correct implementation and validation of segmentation, not on the presence of a rule set alone.
What traffic should ingress rules permit, and how should the rule base be structured?
A common approach is to define ingress rules on a default-deny basis, explicitly permitting only the inbound sources, destinations, ports, and protocols required for documented business or operational needs, and denying everything else. Rules should be specific rather than broad, documented with a business justification, and reviewed periodically to remove entries that are no longer needed. The exact rule set depends on the environment and services exposed, so justification and review are more important than any fixed template.
How do you verify that ingress filtering is working as intended?
Verification generally involves confirming that the configured rules match documented requirements, testing that disallowed inbound traffic is denied and only permitted traffic passes, and reviewing logs for denied and allowed connections. Change management should ensure rule modifications are authorized and recorded. Testing can produce false negatives if it does not exercise all relevant paths, so verification should reflect the actual traffic flows and boundaries in the environment rather than assume coverage.
How should ingress filtering rules be maintained over time?
Maintenance typically includes periodic review of the rule base to identify unused, overly broad, or redundant rules, aligning changes with a documented change-management process, and updating rules when services, addressing, or segmentation change. Keeping documentation current so each rule has a stated business justification supports both operational clarity and audit readiness. The appropriate review frequency and process depend on the organization and any applicable requirements, which should be confirmed against the current published standard.
How does ingress filtering differ from egress filtering, and are both needed?
Ingress filtering controls traffic entering a network boundary from external or less-trusted sources, while egress filtering controls traffic leaving the boundary toward external destinations. They address different directions and threats: ingress filtering helps limit unwanted inbound access, whereas egress filtering may help detect or restrict unauthorized outbound connections, such as data exfiltration or command-and-control traffic. Because they mitigate different risks, they are generally treated as complementary rather than interchangeable, and neither alone provides complete boundary protection.

Common misconceptions

Ingress filtering prevents denial-of-service attacks.
Ingress filtering is intended to help reduce the effectiveness of source-address spoofing, which is a factor in some denial-of-service and reflection techniques. It does not prevent all denial-of-service attacks, including many that use legitimate or unspoofed source addresses, and it should be treated as one layer among several.
Ingress filtering satisfies PCI DSS network security requirements on its own.
Ingress filtering is one boundary control that can support network security objectives, but PCI DSS addresses network controls, segmentation, and traffic restriction more broadly. It is not a substitute for the full set of applicable requirements, and organizations should confirm current requirement wording against the published standard rather than assuming a specific requirement number.
Ingress and egress filtering are interchangeable terms for the same control.
They address different directions of traffic. Ingress filtering validates traffic entering a network and egress filtering constrains traffic leaving it. Both are typically needed as complementary controls, and applying only one leaves the other direction unaddressed.

Best practices

Apply source address validation at network boundary devices to drop inbound traffic bearing implausible or spoofed source addresses, consistent with the expected routing for that interface.
Deploy ingress filtering alongside egress filtering so that both inbound and outbound traffic at the boundary are constrained by explicit rules.
Document and regularly review filtering rulesets and ACLs, updating them as network topology, address ranges, and business needs change.
Treat ingress filtering as one layer within a defense-in-depth approach rather than a standalone control, recognizing it does not mitigate attacks that use legitimate or unspoofed addresses.
Where boundary controls protect a cardholder data environment, map them to the applicable network security and segmentation objectives and confirm exact requirement wording against the current published PCI DSS version.
Validate that filtering rules behave as intended through periodic testing, and account for the possibility of both false positives (legitimate traffic blocked) and false negatives (unwanted traffic passed).