I understand that you can implement a firewall to only allow access to a server from specific IP addresses, but can't people fake the source IP address in a TCP packet? How does this actually stop unscrupulous people from accessing your server?