A network security device to mediate communications between a client computing device and a network, the network security device comprising: a memory storing packet header verification rules defining parameters for structure and content of packet headers; a communications interface to connect to the client computing device and the network; and a processor interconnected with the memory and the communications interface, the processor configured to: in response to receiving an incoming packet from the network for transmission to the client computing device, extract an incoming header from the incoming packet; perform a verification of structure and content of the incoming header according to the packet header verification rules by: obtaining a current routing path from the incoming header of the incoming packet; obtaining a stored routing path from the memory; determining whether the stored routing path and the current routing path include a threshold number of similar points, wherein the threshold number is defined in the packet header verification rules; determining whether one or more locations of the current routing path match locations on a restricted location list defined in the packet header verification rules; and when the stored routing path and the current routing path are determined to include the threshold number of similar points, and none of the locations of the current routing path match the locations on the restricted location list, determining that the verification of the incoming header is successful; and in response to a successful verification of the incoming header, transmit the incoming packet to the client computing device. a memory storing packet header verification rules defining parameters for structure and content of packet headers; a communications interface to connect to the client computing device and the network; and a processor interconnected with the memory and the communications interface, the processor configured to: in response to receiving an incoming packet from the network for transmission to the client computing device, extract an incoming header from the incoming packet; perform a verification of structure and content of the incoming header according to the packet header verification rules by: obtaining a current routing path from the incoming header of the incoming packet; obtaining a stored routing path from the memory; determining whether the stored routing path and the current routing path include a threshold number of similar points, wherein the threshold number is defined in the packet header verification rules; determining whether one or more locations of the current routing path match locations on a restricted location list defined in the packet header verification rules; and when the stored routing path and the current routing path are determined to include the threshold number of similar points, and none of the locations of the current routing path match the locations on the restricted location list, determining that the verification of the incoming header is successful; and in response to a successful verification of the incoming header, transmit the incoming packet to the client computing device. in response to receiving an incoming packet from the network for transmission to the client computing device, extract an incoming header from the incoming packet; perform a verification of structure and content of the incoming header according to the packet header verification rules by: obtaining a current routing path from the incoming header of the incoming packet; obtaining a stored routing path from the memory; determining whether the stored routing path and the current routing path include a threshold number of similar points, wherein the threshold number is defined in the packet header verification rules; determining whether one or more locations of the current routing path match locations on a restricted location list defined in the packet header verification rules; and when the stored routing path and the current routing path are determined to include the threshold number of similar points, and none of the locations of the current routing path match the locations on the restricted location list, determining that the verification of the incoming header is successful; and obtaining a current routing path from the incoming header of the incoming packet; obtaining a stored routing path from the memory; determining whether the stored routing path and the current routing path include a threshold number of similar points, wherein the threshold number is defined in the packet header verification rules; determining whether one or more locations of the current routing path match locations on a restricted location list defined in the packet header verification rules; and when the stored routing path and the current routing path are determined to include the threshold number of similar points, and none of the locations of the current routing path match the locations on the restricted location list, determining that the verification of the incoming header is successful; and in response to a successful verification of the incoming header, transmit the incoming packet to the client computing device.