In the case of your firewall you are worried about someone establishing a connection and sending and receiving data, if someone was able to spoof an IP address, the return information would be sent to that IP address and so the “sender” would never receive it.

Also, services that are TCP oriented would probably reject that packet along the way, so it is unlikely to even reach the destination in the first place.

IP address spoofing is mostly used to create denial of service attacks on UDP based systems.

So the short answer is that you don’t have to worry about IP address spoofing. Plus in addition to the IP Address the assumption is that the user is still accessing a remote service that has some sort of authentication.

So you don’t have to worry about it.