We could reject all packets with a spoofed IP address by only accepting packets
where the source address is in our subnet:

# iptables -A OUTPUT -j DROP
# iptables -A OUTPUT -s 203.0.113.0/24 ACCEPT