Is it possible to send network messages with "Fake" Local Network(192.168.x.x) destination IP but actually reaches the destination via internet?

Question

I am configuring a MySQL server that is only intended for computers from internal network/local network machines to access.

Now MySQL has a "bind IP address" setting that, if I set it to the IP address in local network "192.168.2.100", it will only listen to messages coming to that IP address, which means it only accepts requests within the local network and not the outside internet.

Now I am wondering whether this is actually "safe", or is there a possibility someone might actually create a "fake" message, where it can both reach my MySQL server from the outside internet while simultaneously having the "bind" restriction satisfied.

Theoretically this should be "safe" but I am not familiar with the actual network packet format so there might still be loopholes, which is why I am asking this question.

Disconnecting my router from outside network physically is not an option for me. Any help would be appreciated.

Answer 1

if I set it to the IP address in local network "192.168.2.100", it will only listen to messages coming to that IP address, which means it only accepts requests within the local network and not the outside internet.

That is true only to some extent. With the common technique of port forwarding aka destination NAT or reverse NAT, a local service using private addressing can be deliberately made accessible from the open Internet. Your service is "safe" as long as you don't set up that port forwarding.

is there a possibility someone might actually create a "fake" message, where it can both reach my MySQL server from the outside internet while simultaneously having the "bind" restriction satisfied.

Not without port forwarding. Anyone trying to reach your service using the locally used private address will fail due to routing - there's simply no way to route a private destination address across the Internet, by convention. Even if someone actually succeeds in getting such a packet to your router's WAN port (only your ISP could do that), the router won't accept it.

So, as long as your router is working properly and you don't set up port forwarding, all that cannot happen. If you want to go the extra mile to exclude even the possibility of router misconfiguration, you could use a local firewall on the server to drop all traffic initiated from outside your LAN. Note that host configurations are explicitly off-topic here though.