XK0-004 · Question #380
An administrator is setting UP a NAT gateway. Two interfaces have been configured: The firewall configuration has been completed: The IP forwarding configuration parameter is: When testing the NAT fro
The correct answer is A. The MASQUERADE source and destination are in the incorrect order,. The NAT/MASQUERADE iptables rule has the source and destination arguments reversed, preventing outbound packets from being correctly matched and translated.
Question
An administrator is setting UP a NAT gateway. Two interfaces have been configured:
The firewall configuration has been completed:
The IP forwarding configuration parameter is:
When testing the NAT from a workstation, the administrator encounters an issue:
Which of the following is the MOST likely cause of the packet loss?
Options
- AThe MASQUERADE source and destination are in the incorrect order,
- BThe firewall is blocking the connection.
- CThe etho interface is wrong.
- DIPv4 forwarding has not been enabled on the NAT gateway
How the community answered
(32 responses)- A47% (15)
- B9% (3)
- C16% (5)
- D28% (9)
Why each option
The NAT/MASQUERADE iptables rule has the source and destination arguments reversed, preventing outbound packets from being correctly matched and translated.
In iptables, a MASQUERADE rule in the POSTROUTING chain must specify the source network (-s) before the outgoing interface (-o) for the rule to match outbound packets correctly. When these arguments are reversed, the rule fails to match traffic leaving the internal network, so packets are dropped at the gateway instead of being NATted. Correcting the argument order restores proper address translation and resolves the packet loss.
The scenario explicitly states the firewall configuration has been completed, and no evidence in the question points to a blocking rule as the cause of packet loss.
The eth0 interface is described as properly configured during setup, so an incorrect interface assignment is not responsible for the issue.
The question states the IP forwarding configuration parameter is already set, confirming IPv4 forwarding is enabled on the NAT gateway.
Concept tested: iptables NAT MASQUERADE rule argument ordering
Source: https://www.netfilter.org/documentation/HOWTO/NAT-HOWTO.html
Topics
Community Discussion
No community discussion yet for this question.