What does the following iptables rule accomplish: iptables -A INPUT -s !127.0.0.0/8 -p tcp -dport 111 -j DROP

Question

Options

• ADrops all packets from the LAN destined for port 111.
• BDrops all packets originating from the local machine unless they are destined for port 111.
• CDrops all packets destined for port 111 which originate from the local machine.
• DDrops all packets destined for port 111 unless they are from the local machine.

• A
  9% (2)
• B
  13% (3)
• C
  4% (1)
• D
  74% (17)

Explanation

Option D is correct because -s !127.0.0.0/8 uses the ! (NOT) operator to match any source address outside the loopback range, combined with --dport 111, this tells iptables to drop TCP traffic headed to port 111 from anyone except the local machine - effectively protecting the portmapper/rpcbind service from external access while keeping localhost communication intact.

Why the distractors fail:

• A is wrong because the rule isn't scoped to LAN addresses - it covers all non-loopback sources, including internet addresses, not just local network traffic.
• B inverts the logic entirely - the rule drops traffic to port 111 from non-local sources, not traffic from the local machine.
• C is the mirror image of the truth - the ! negation means loopback traffic is the exception that gets through, not the traffic that gets dropped.

Memory tip: Read ! as "NOT" and parse left to right - !127.0.0.0/8 means "source is NOT loopback," so the DROP action hits everyone outside loopback. A useful shorthand: if ! appears before the source, the rule protects that source by dropping everyone else.

No community discussion yet for this question.