Linux Firewall and Network Security 3 — Questions and Answers
Question 1: Which tool is the recommended modern replacement for iptables on systems using nftables as the backend?
- ufw
- ipfw
- iptables-nft (Correct answer)
- firewall-cmd
Correct answer: iptables-nft
iptables-nft is a compatibility layer that translates iptables syntax to nftables rules, bridging the two frameworks.
Question 2: What does the 'INVALID' connection state mean in iptables stateful filtering?
- The packet is from an untrusted source IP
- The packet doesn't match any known connection or is malformed (Correct answer)
- The packet has an expired TTL
- The packet lacks a valid TCP checksum
Correct answer: The packet doesn't match any known connection or is malformed
INVALID means the packet cannot be associated with any tracked connection and may indicate a scan or attack.
Question 3: In firewalld, which command lists all available predefined services that can be added to a zone?
- firewall-cmd --list-services
- firewall-cmd --get-services (Correct answer)
- firewall-cmd --show-services
- firewall-cmd --query-services
Correct answer: firewall-cmd --get-services
'--get-services' lists all predefined service names available in firewalld's service directory.
Question 4: Which iptables module allows you to match packets based on the time of day or day of the week?
- -m schedule
- -m time (Correct answer)
- -m cron
- -m clock
Correct answer: -m time
The 'time' match module lets you apply rules based on time ranges, dates, and days of the week.
Question 5: What does 'ip6tables' manage compared to 'iptables'?
- IPv4 packet filtering with 6 tables
- IPv6 packet filtering rules (Correct answer)
- Layer 6 network protocol filtering
- Extended iptables with 6 additional chains
Correct answer: IPv6 packet filtering rules
ip6tables is the IPv6-specific counterpart to iptables and manages netfilter rules for IPv6 traffic.
Question 6: Which command makes iptables rules persistent across reboots on Debian/Ubuntu systems?
- systemctl enable iptables
- iptables-save > /etc/iptables/rules.v4 (Correct answer)
- service iptables save
- iptables --persist
Correct answer: iptables-save > /etc/iptables/rules.v4
On Debian/Ubuntu, iptables-save redirects rules to /etc/iptables/rules.v4, which iptables-restore loads at boot via the iptables-persistent package.
Question 7: What is the effect of setting the default policy of the FORWARD chain to DROP?
- Prevents all new SSH connections
- Stops all traffic from being routed between network interfaces (Correct answer)
- Blocks all outbound traffic
- Disables NAT masquerading
Correct answer: Stops all traffic from being routed between network interfaces
The FORWARD chain handles routed traffic passing through the Linux host; a DROP default blocks all such inter-interface routing.
Linux Firewall and Network Security 3
Which tool is the recommended modern replacement for iptables on systems using nftables as the backend?