LFCS · Question #227
What does the following iptables rule accomplish: iptables A INPUT s !127.0.0.0/8 p tcp dport 111 j DROP
The correct answer is D. Drops all packets destined for port 111 unless they are from the local machine. This iptables rule blocks all incoming TCP traffic on port 111 unless it originates from the local host (localhost or 127.0.0.0/8 subnet).
Question
Options
- ADrops all packets from the LAN destined for port 111.
- BDrops all packets originating from the local machine unless they are destined for port 111.
- CDrops all packets destined for port 111 which originate from the local machine.
- DDrops all packets destined for port 111 unless they are from the local machine.
How the community answered
(47 responses)- B2% (1)
- C4% (2)
- D94% (44)
Why each option
This `iptables` rule blocks all incoming TCP traffic on port 111 unless it originates from the local host (localhost or 127.0.0.0/8 subnet).
The rule specifically excludes `127.0.0.0/8` which refers to localhost, not the general LAN, and it applies to any source outside localhost, not just the LAN.
The rule is in the `INPUT` chain, meaning it processes incoming packets destined for the local machine, not packets originating from the local machine.
The rule explicitly uses `!127.0.0.0/8` for the source, meaning it applies to packets *not* originating from the local machine.
The `iptables -A INPUT` command adds a rule to the `INPUT` chain. The `-s !127.0.0.0/8` specifies any source IP address that is NOT within the `127.0.0.0/8` (localhost) network range. The `-p tcp` specifies the TCP protocol, and `--dport 111` specifies destination port 111. Finally, `-j DROP` means packets matching these conditions will be silently discarded. This effectively drops non-localhost traffic destined for port 111.
Concept tested: Iptables rule interpretation (negation, source network, port)
Source: https://linux.die.net/man/8/iptables
Topics
Community Discussion
No community discussion yet for this question.