Which of the following commands changes the source IP address to 192.0.2.11 for all IPv4 packets which go through the network interface eth0?

Question

Options

• Aiptables ~t nat ~A POSTROUTING ~o eth0 j SNAT --tosource 192.0.2.11
• Biptables ~t nat ~A PREROUTING ~i eth0 j SNAT --tosource 192.0.2.11
• Ciptables ~t nat ~A POSTROUTING ~i eth0 j DNAT --tosource 192.0.2.11
• Diptables ~t mangle ~A POSTROUTING ~i eth0 j SNAT -tosource 192.0.2.11
• Eiptables ~t mangle ~A POSTROUTING ~0 eth0 j SNAT -tosource 192.0.2.11

• A
  74% (17)
• B
  9% (2)
• D
  13% (3)
• E
  4% (1)

Explanation

Option A is correct because SNAT (Source NAT) must use the nat table (-t nat), the POSTROUTING chain (source rewriting happens after routing decisions, as packets leave the system), and the output interface flag -o eth0 (packets exiting through eth0). The --to-source flag then specifies the new source IP.

Why the distractors fail:

• B uses PREROUTING - SNAT is invalid there; PREROUTING is where DNAT (destination NAT) belongs, since destination changes must happen before routing.
• C uses the DNAT target, which rewrites the destination IP, not the source. It also incorrectly uses -i (input interface) in POSTROUTING, which requires -o (output interface).
• D uses the mangle table - SNAT is only valid in the nat table. It also uses -i (input) instead of -o (output), and has a malformed single-dash --to-source.
• E compounds mangle's invalidity with -0 (a zero, not the letter o), making the interface match syntactically broken.

Memory tip: Think "SNAT = Send it out (POSTROUTING, -o)" vs. "DNAT = Direct incoming (PREROUTING, -i)". Source is changed last (post), destination is changed first (pre).

No community discussion yet for this question.