What does the following iptables rule accomplish: iptables A INPUT s !127.0.0.0/8 p tcp dport 111 j DROP

Carlos M.May 3, 2026

D is the right answer. The rule appends to the INPUT chain, matches source addresses that are NOT in the 127.0.0.0/8 range (that exclamation mark negates the match), and drops TCP packets headed to port 111. Port 111 is the portmapper/rpcbind service, so this is a classic way to block outside access to RPC while still letting localhost traffic through. Anything coming from 127.x.x.x is not matched by the negated source filter, so it passes right through to the next rule or the default policy, which is exactly what you want for local RPC calls.

Grace U.Mar 15, 2026

The rule appends to the INPUT chain and matches any TCP packet headed to port 111 where the source is anything other than 127.0.0.0/8, then drops it. That "!" in front of the source address is the key, it inverts the match, so the rule only fires when the source is NOT the loopback range. Traffic that does come from 127.0.0.0/8 never matches the rule and passes right through. That makes D the correct answer: packets destined for port 111 are dropped unless they originate from the local machine (the loopback range), which is exactly what that inverted source match enforces.

Imani T.Apr 6, 2026

The bang operator in front of 127.0.0.0/8 is doing all the work here, and if you missed it you probably circled C or B and felt confident. The exclamation mark negates the source, so the rule is saying drop TCP traffic headed to port 111 from anything that is NOT the loopback range, which means only loopback traffic gets through to that port. That is D, and D is right. A is tempting because port 111 is portmapper and blocking it from the LAN makes intuitive security sense, but the rule does not say LAN, it says anything outside 127.0.0.0/8, which would include the LAN and external traffic both, so A undersells the scope. C has the logic completely backwards, it says drop from local machine which is the exact opposite of what the negation does. Stick with D.

Ingrid P.Mar 23, 2026

I first flagged C in my notes, assuming the exclamation point was just emphasizing the loopback address as the source rather than negating it, which is a sloppy read. What snapped me out of it was remembering that in iptables, the bang before the address is a logical NOT, so the rule matches any source that is NOT in 127.0.0.0/8, meaning it only fires on traffic that did not originate from the local machine. That makes D the only reading that holds up: port 111 traffic from outside the loopback range gets dropped, while anything the local machine generates to that port passes through untouched. This is worth a dedicated card with the front asking what the bang modifier does to a source address, because the negation logic is exactly the kind of syntax detail that trips people up under time pressure.

Nina C.May 20, 2026

Does the exclamation mark flip the match so it blocks everything *except* loopback, meaning D?

Orla P.May 27, 2026

Saw this exact rule on my 303 sitting a few years back and the key that unlocked it for me was reading the exclamation point in front of the source address, which means "not 127.0.0.0/8," so anything that is NOT the local loopback gets dropped on port 111, making D the only one that says it right. Once you train yourself to catch that bang operator as a negation, these iptables questions stop feeling like traps.

Ola B.May 10, 2026

I initially went with C because my brain jumped straight to "local machine, port 111, DROP" and skimmed past the negation operator, but once I spun up a quick test box and actually ran the rule I had to slow down and read it properly. The exclamation mark in front of 127.0.0.0/8 flips the source match, so the rule is catching everything that does NOT come from loopback, not everything that does. That makes D the right call, since only traffic originating from the local machine gets through to port 111, and anything coming in from outside that loopback range gets silently dropped. If you are blanking on the negation syntax, just lab it out with tcpdump on the side and send a packet from a second machine to port 111, you will watch it vanish and the logic clicks fast.

Marit C.Mar 3, 2026

Has to be A, because that source negation with !127.0.0.0/8 is matching everything that is NOT loopback, which in practice on a typical single-homed box means your LAN-sourced traffic, and then it drops anything from that space hitting port 111, which is rpcbind and exactly the kind of thing you lock down from the local network segment. The rule appends to INPUT, so it is catching inbound packets from outside the loopback range before they reach rpcbind, which reads to me as a LAN drop rule all day long.

Mateus R.Mar 17, 2026

Okay so think of it like a bouncer at a club who has a specific block list. The bouncer's job here is to stop anyone trying to get to room 111, the portmapper/RPC service, which is a classic target for exploitation. The source flag with the exclamation point means "not this address range," so the rule is saying drop packets that do NOT come from 127.0.0.0/8, which is the loopback block, meaning anything coming in from outside the local machine gets the door slammed in its face on port 111. Now, 127.0.0.0/8 is loopback, not your LAN, so you might think that rules out A, but here is where I think people trip up on exam wording. The LAN traffic is absolutely the practical target here because loopback stays on the machine itself and never touches the INPUT chain for real external packets in a meaningful attack scenario. So the traffic this rule is realistically catching and dropping is your LAN traffic headed for port 111, which makes A the sensible read of what this accomplishes in a real deployment. The other options try to flip the logic around and talk about packets originating from the local machine, but the INPUT chain handles inbound traffic, not traffic you are sending out yourself, so D and C just don't fit the chain we are working with here.