XK0-005 · Question #74
An administrator is attempting to block SSH connections to 192.168.10.24 using the Linux firewall. After implementing a rule, a connection refused error is displayed when attempting to SSH to…
The correct answer is A. iptables -A -p tcp -d 192.168.10.24 -dropt 22 -j REJECT. Implementing an iptables rule with the REJECT target for SSH connections would most likely result in a "Connection refused" error message on the client.
Question
An administrator is attempting to block SSH connections to 192.168.10.24 using the Linux firewall. After implementing a rule, a connection refused error is displayed when attempting to SSH to 192.168.10.24. Which of the following rules was MOST likely implemented?
Options
- Aiptables -A -p tcp -d 192.168.10.24 -dropt 22 -j REJECT
- Biptables -A -p tcp -d 192.168.10.24 -dropt 22 -j DROP
- Ciptables -A -p tcp -d 192.168.10.24 -dropt 22 -j FORWARD
- Diptables -A -p tcp -d 192.168.10.24 -dropt 22 -j REFUSE
How the community answered
(50 responses)- A72% (36)
- B16% (8)
- C8% (4)
- D4% (2)
Why each option
Implementing an iptables rule with the `REJECT` target for SSH connections would most likely result in a "Connection refused" error message on the client.
The `REJECT` target in `iptables` sends an error packet back to the sender, such as an ICMP port unreachable or TCP RST, which typically results in a "Connection refused" message on the client attempting to establish an SSH connection. (Assuming -dropt is a typo for --dport).
The `DROP` target in `iptables` discards the packet silently without sending any response, leading to a connection timeout on the client side, not a "Connection refused" error.
The `FORWARD` target is used for packets routed through the firewall to another destination, not for blocking connections directed to the firewall itself.
`REFUSE` is not a valid target in `iptables`; the correct target for sending an error response is `REJECT`.
Concept tested: iptables REJECT vs DROP
Source: https://ipset.netfilter.org/iptables-extensions.man.html
Topics
Community Discussion
No community discussion yet for this question.