Linux Firewall and Network Security 5 — Questions and Answers
Question 1: Which iptables target sends a TCP RST packet back to the sender instead of silently dropping?
- DROP
- REJECT --reject-with tcp-reset (Correct answer)
- RESET
- DENY
Correct answer: REJECT --reject-with tcp-reset
REJECT with '--reject-with tcp-reset' sends a TCP RST, causing the sender to see a closed port rather than a timeout.
Question 2: What does the 'hashlimit' iptables module do differently compared to the 'limit' module?
- It uses SHA hashing to identify packets
- It applies rate limits per source IP, destination, or port combination (Correct answer)
- It limits total hash table memory usage
- It rate-limits based on packet payload hashes
Correct answer: It applies rate limits per source IP, destination, or port combination
hashlimit allows per-source-IP (or per-connection) rate limiting, unlike 'limit' which applies a single global rate.
Question 3: In nftables, what keyword is used to create a stateful firewall rule accepting established and related traffic?
- ct state { established, related } accept (Correct answer)
- state established,related ACCEPT
- conntrack state=ESTABLISHED,RELATED -j ACCEPT
- match state established related permit
Correct answer: ct state { established, related } accept
nftables uses 'ct state' (connection tracking state) with set notation to match multiple states in one expression.
Question 4: Which file defines the default firewalld zone for network interfaces not explicitly assigned to a zone?
- /etc/firewalld/zones/default.xml
- /etc/firewalld/firewalld.conf (Correct answer)
- /etc/sysconfig/firewalld
- /usr/lib/firewalld/firewalld.conf
Correct answer: /etc/firewalld/firewalld.conf
The DefaultZone setting in /etc/firewalld/firewalld.conf determines which zone is applied to interfaces without an explicit zone assignment.
Question 5: What iptables rule would block all outbound SMTP traffic from a Linux server on port 25?
- iptables -A INPUT -p tcp --dport 25 -j DROP
- iptables -A OUTPUT -p tcp --dport 25 -j DROP (Correct answer)
- iptables -A FORWARD -p tcp --sport 25 -j DROP
- iptables -A OUTPUT -p tcp --sport 25 -j DROP
Correct answer: iptables -A OUTPUT -p tcp --dport 25 -j DROP
To block locally-initiated outbound connections on port 25, add a DROP rule to the OUTPUT chain matching destination port 25.
Question 6: What is 'port knocking' in the context of Linux firewall security?
- Scanning all ports to identify open services
- A technique where a specific sequence of connection attempts opens a firewall port (Correct answer)
- Rate limiting port scans using iptables
- Forwarding traffic from one port to another
Correct answer: A technique where a specific sequence of connection attempts opens a firewall port
Port knocking keeps ports closed until a predefined sequence of connection attempts is detected, then dynamically opens access.
Question 7: Which command checks whether a specific firewalld service is currently active (runtime) in the public zone?
- firewall-cmd --zone=public --list-services
- firewall-cmd --zone=public --query-service=http (Correct answer)
- firewall-cmd --zone=public --check-service=http
- firewall-cmd --zone=public --get-service=http
Correct answer: firewall-cmd --zone=public --query-service=http
'--query-service' returns 'yes' or 'no' indicating whether the service is currently enabled in the specified zone at runtime.
Linux Firewall and Network Security 5
Which iptables target sends a TCP RST packet back to the sender instead of silently dropping?