nerdexam
CompTIA

LX0-104 · Question #227

What does the following iptables rule accomplish: iptables A INPUT s !127.0.0.0/8 p tcp dport 111 j DROP

The correct answer is D. Drops all packets destined for port 111 unless they are from the local machine.. This iptables rule drops incoming TCP packets destined for port 111 unless their origin is within the local loopback network.

Security

Question

What does the following iptables rule accomplish: iptables A INPUT s !127.0.0.0/8 p tcp dport 111 j DROP

Options

  • ADrops all packets from the LAN destined for port 111.
  • BDrops all packets originating from the local machine unless they are destined for port 111.
  • CDrops all packets destined for port 111 which originate from the local machine.
  • DDrops all packets destined for port 111 unless they are from the local machine.

How the community answered

(48 responses)
  • A
    2% (1)
  • B
    6% (3)
  • C
    13% (6)
  • D
    79% (38)

Why each option

This iptables rule drops incoming TCP packets destined for port 111 unless their origin is within the local loopback network.

ADrops all packets from the LAN destined for port 111.

The rule drops packets from any non-local source, not just the LAN, for port 111.

BDrops all packets originating from the local machine unless they are destined for port 111.

The `INPUT` chain processes incoming packets to the local machine, not packets originating from the local machine.

CDrops all packets destined for port 111 which originate from the local machine.

The `!127.0.0.0/8` specifies sources *not* from the local machine, meaning it drops packets *unless* they are from the local machine, which contradicts dropping packets originating from the local machine.

DDrops all packets destined for port 111 unless they are from the local machine.Correct

The `iptables -A INPUT` command appends a rule to the `INPUT` chain; `-s !127.0.0.0/8` negates the source match, meaning any source IP *not* in the 127.0.0.0/8 loopback range; `-p tcp --dport 111` matches TCP traffic for port 111; and `-j DROP` discards these packets, effectively dropping traffic for port 111 unless it is from the local machine.

Concept tested: Iptables rule syntax - negation, source IP range, destination port, and DROP target

Source: https://man7.org/linux/man-pages/man8/iptables.8.html

Topics

#iptables rules#negation#loopback interface#DROP action

Community Discussion

No community discussion yet for this question.

Full LX0-104 Practice