A statefull firewall can tell if the HTTP connection is starting from inside the network by looking at the transport layer TCP SYN (synchronize) as well as IP address source. What should it do if someone from the outside is pretending to be an “interior” IP address?