If I understand your configuration, both your test Win7 and BT virtual machines are on the 10/8 network.
Antispoof is designed to prevent
external attacks from pretending they are using internal addresses. It does not do what you assume.
Please do the following:
- Read the Blocking Spoofed Packets section in the Packet Filtering chapter of the PF User's Guide.
- Use "# pfctl -s rules" to see the expansion of the antispoof command into specific filter rules in your test environment.
- Configure a new test, where your attacker is outside the subnet to be protected.