Linux Firewall and Network Security 4 — Questions and Answers
Question 1: Which nftables hook corresponds to locally generated outbound traffic on a Linux host?
- prerouting
- forward
- input
- output (Correct answer)
Correct answer: output
The 'output' hook in nftables processes packets generated by local processes before they leave the network interface.
Question 2: What firewall technique does 'iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE' implement?
- Port forwarding
- IP masquerading (source NAT) (Correct answer)
- Destination NAT
- Packet marking
Correct answer: IP masquerading (source NAT)
MASQUERADE is a form of SNAT that dynamically replaces the source IP with the outbound interface's IP, used for internet sharing.
Question 3: Which iptables module limits the rate of log messages to prevent log flooding?
- -m throttle
- -m limit (Correct answer)
- -m rate
- -m quota
Correct answer: -m limit
The 'limit' module restricts how frequently a rule matches, commonly paired with LOG to prevent syslog from being overwhelmed.
Question 4: In SELinux, what does the 'enforcing' mode do to policy violations?
- Logs violations but allows them
- Blocks and logs violations (Correct answer)
- Only logs to audit.log without blocking
- Disables all network policies
Correct answer: Blocks and logs violations
Enforcing mode actively blocks actions that violate SELinux policy and records denials in the audit log.
Question 5: Which command adds a rich rule in firewalld to block all traffic from the IP 192.168.1.100?
- firewall-cmd --add-rule='rule family=ipv4 source address=192.168.1.100 drop'
- firewall-cmd --add-rich-rule='rule family=ipv4 source address=192.168.1.100 drop' (Correct answer)
- firewall-cmd --block-ip=192.168.1.100
- firewall-cmd --zone=public --reject-source=192.168.1.100
Correct answer: firewall-cmd --add-rich-rule='rule family=ipv4 source address=192.168.1.100 drop'
firewalld rich rules use the '--add-rich-rule' flag with a structured rule string to allow complex matching conditions.
Question 6: What is the primary purpose of the 'raw' table in iptables?
- Handles unencrypted plaintext traffic
- Allows rules to exempt packets from connection tracking (Correct answer)
- Stores raw packet captures
- Processes traffic before NAT
Correct answer: Allows rules to exempt packets from connection tracking
The raw table is processed before conntrack and is used with NOTRACK to exempt specific traffic from connection state tracking.
Question 7: Which /proc entry shows the current number of tracked connections in the netfilter connection table?
- /proc/net/ip_conntrack_count
- /proc/sys/net/netfilter/nf_conntrack_count (Correct answer)
- /proc/net/nf_conntrack_total
- /proc/sys/net/ipv4/conntrack/current
Correct answer: /proc/sys/net/netfilter/nf_conntrack_count
/proc/sys/net/netfilter/nf_conntrack_count displays the current number of active entries in the connection tracking table.
Linux Firewall and Network Security 4
Which nftables hook corresponds to locally generated outbound traffic on a Linux host?