LX0-104 · Question #227
What does the following iptables rule accomplish: iptables A INPUT s !127.0.0.0/8 p tcp dport 111 j DROP
The correct answer is D. Drops all packets destined for port 111 unless they are from the local machine.. This iptables rule drops incoming TCP packets destined for port 111 unless their origin is within the local loopback network.
Question
Options
- ADrops all packets from the LAN destined for port 111.
- BDrops all packets originating from the local machine unless they are destined for port 111.
- CDrops all packets destined for port 111 which originate from the local machine.
- DDrops all packets destined for port 111 unless they are from the local machine.
How the community answered
(48 responses)- A2% (1)
- B6% (3)
- C13% (6)
- D79% (38)
Why each option
This iptables rule drops incoming TCP packets destined for port 111 unless their origin is within the local loopback network.
The rule drops packets from any non-local source, not just the LAN, for port 111.
The `INPUT` chain processes incoming packets to the local machine, not packets originating from the local machine.
The `!127.0.0.0/8` specifies sources *not* from the local machine, meaning it drops packets *unless* they are from the local machine, which contradicts dropping packets originating from the local machine.
The `iptables -A INPUT` command appends a rule to the `INPUT` chain; `-s !127.0.0.0/8` negates the source match, meaning any source IP *not* in the 127.0.0.0/8 loopback range; `-p tcp --dport 111` matches TCP traffic for port 111; and `-j DROP` discards these packets, effectively dropping traffic for port 111 unless it is from the local machine.
Concept tested: Iptables rule syntax - negation, source IP range, destination port, and DROP target
Source: https://man7.org/linux/man-pages/man8/iptables.8.html
Topics
Community Discussion
No community discussion yet for this question.