Linux Firewall and Network Security — Questions and Answers

Question 1: Which command is used to list all current iptables rules in a Linux system?

iptables -L (Correct answer)
iptables --show
iptables -list
iptables -display

Correct answer: iptables -L

The `iptables -L` command lists all current firewall rules in all chains. Adding -v gives verbose output and -n prevents DNS lookups.

iptables -L (or --list) displays all rules in the filter table by default. Use -t to specify another table (e.g., -t nat). The -v flag adds packet/byte counters and interface names, while -n prevents reverse DNS lookups that can slow output. For persistent viewing, combine with -n -v --line-numbers to see rule line numbers for insertion or deletion.

Question 2: In iptables, which chain handles packets destined for the local system?

INPUT (Correct answer)
OUTPUT
FORWARD
PREROUTING

Correct answer: INPUT

The INPUT chain processes packets that are destined for the local machine itself, not forwarded to another host.

iptables has three default chains in the filter table: INPUT (packets destined for the local system), OUTPUT (packets generated by the local system), and FORWARD (packets routed through the system). PREROUTING and POSTROUTING exist in the nat and mangle tables and handle packets before and after routing decisions, respectively.

Question 3: What does the `-j DROP` option do in an iptables rule?

Silently discards matching packets (Correct answer)
Sends a rejection notice to the sender
Logs the packet and drops it
Forwards the packet to another chain

Correct answer: Silently discards matching packets

DROP silently discards packets without notifying the sender, unlike REJECT which sends an error message back.

The DROP target silently discards packets without sending any response, which can slow port scanning since the scanner waits for a timeout. REJECT sends back an ICMP unreachable or TCP RST, which is faster but reveals the firewall's presence. DROP is generally preferred for external-facing rules to obscure the network topology, while REJECT may be preferable on internal networks so clients know immediately that a connection is refused.

Question 4: Which firewall tool is the default frontend for managing netfilter on modern systemd-based Linux distributions?

firewalld (Correct answer)
iptables
ufw
nftables

Correct answer: firewalld

firewalld is the default dynamic firewall daemon used on RHEL/CentOS/Fedora systems, providing a zone-based interface to netfilter.

firewalld is a dynamic firewall daemon that provides a D-Bus interface and supports zones (trusted, public, home, work, etc.) for grouping network interfaces. It wraps nftables (or iptables on older systems) and allows rule changes without restarting the firewall service. The firewall-cmd CLI and a GUI tool (firewall-config) are the main interfaces. On Ubuntu/Debian systems, ufw (Uncomplicated Firewall) is more common.

Question 5: What command allows you to add a permanent rule in firewalld to open port 443/tcp in the public zone?

firewall-cmd --zone=public --add-port=443/tcp --permanent (Correct answer)
firewall-cmd --add-port=443 --zone=public
firewall-cmd --open=443/tcp --permanent
firewall-cmd --zone=public --port=443 --enable

Correct answer: firewall-cmd --zone=public --add-port=443/tcp --permanent

The correct syntax uses --add-port=443/tcp with --permanent to persist the rule across reboots, followed by --reload to apply it.

firewall-cmd --zone=public --add-port=443/tcp --permanent adds the rule to the permanent configuration. Without --permanent, changes are runtime-only and lost on reload or reboot. After adding a permanent rule, run firewall-cmd --reload to apply it to the running configuration. To verify: firewall-cmd --zone=public --list-ports. To remove: firewall-cmd --zone=public --remove-port=443/tcp --permanent.

Question 6: Which nftables command lists all current rules and tables?

nft list ruleset (Correct answer)
nft show rules
nft -L
nft display all

Correct answer: nft list ruleset

nft list ruleset displays the complete ruleset including all tables, chains, and rules in a human-readable format.

nft list ruleset outputs the entire nftables configuration in a format that can be redirected to a file and reloaded with nft -f. Other useful commands include nft list tables (lists table names), nft list table inet filter (lists a specific table), and nft list chain inet filter input (lists a specific chain). nftables replaced iptables, ip6tables, arptables, and ebtables with a unified tool.

Question 7: What is the purpose of the UFW (Uncomplicated Firewall) command `ufw enable`?

Activates the firewall and enables it to start on boot (Correct answer)
Only enables the firewall for the current session
Reloads the firewall rules without enabling it
Creates a default allow-all policy

Correct answer: Activates the firewall and enables it to start on boot

ufw enable both activates the firewall immediately and configures it to start automatically on system boot.

Running ufw enable starts the firewall service and sets it to start on boot. Before enabling, it's important to ensure SSH (port 22) is allowed with 'ufw allow ssh' or 'ufw allow 22/tcp' to avoid locking yourself out. The default policies are configurable with 'ufw default deny incoming' and 'ufw default allow outgoing'. Use 'ufw status verbose' to check the current state and all rules.

Question 8: In iptables, what does the `-m state --state ESTABLISHED,RELATED` match condition do?

Matches packets that are part of or related to an existing connection (Correct answer)
Matches only new connection attempts
Matches all UDP packets regardless of state
Matches packets in the INVALID state only

Correct answer: Matches packets that are part of or related to an existing connection

This stateful matching allows return traffic for already-established connections, essential for a functional firewall that only blocks inbound new connections.

Connection tracking (conntrack) in netfilter assigns states to packets: NEW (first packet of a connection), ESTABLISHED (part of an ongoing connection), RELATED (related to an established connection, like FTP data), and INVALID. A typical stateful firewall has a rule like: iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT before any deny rules, so that legitimate return traffic is always permitted.

Question 9: Which command would you use to block all incoming traffic from IP address 203.0.113.5?

iptables -A INPUT -s 203.0.113.5 -j DROP (Correct answer)
iptables -A INPUT -d 203.0.113.5 -j DROP
iptables -B INPUT -s 203.0.113.5 -j DROP
iptables -BLOCK -s 203.0.113.5

Correct answer: iptables -A INPUT -s 203.0.113.5 -j DROP

The -s flag specifies the source IP address, and -j DROP silently discards matching inbound packets.

iptables -A INPUT -s 203.0.113.5 -j DROP appends a rule to the INPUT chain to drop all traffic from source IP 203.0.113.5. To block a range use CIDR notation, e.g. -s 203.0.113.0/24. For persistent blocking, add this to your firewall startup script or use iptables-save/iptables-restore. ipset is more efficient for blocking large numbers of IPs, as it uses hash sets instead of linear rule traversal.

Question 10: What does the `ss -tuln` command show?

All TCP and UDP listening sockets with numeric addresses (Correct answer)
Active SSH tunnels only
Network interface statistics
Routing table entries

Correct answer: All TCP and UDP listening sockets with numeric addresses

ss -tuln shows TCP (-t) and UDP (-u) listening (-l) sockets with numeric (-n) addresses and ports, useful for auditing open services.

The ss command (socket statistics) replaces the older netstat. Flags: -t (TCP), -u (UDP), -l (listening only), -n (numeric, no DNS lookups), -p (show processes). 'ss -tulnp' shows the same info plus which process/PID owns each socket. This is an essential security audit tool to find unexpected open ports. Compare with 'netstat -tuln' which has the same output format on older systems.

Question 11: Which file stores persistent iptables rules on RHEL/CentOS 7+ systems when using the iptables-services package?

/etc/sysconfig/iptables (Correct answer)
/etc/iptables/rules.v4
/etc/firewall/iptables.conf
/var/lib/iptables/rules

Correct answer: /etc/sysconfig/iptables

On RHEL/CentOS systems using iptables-services, rules are saved to /etc/sysconfig/iptables and loaded at boot.

On RHEL/CentOS, 'service iptables save' or 'iptables-save > /etc/sysconfig/iptables' persists rules. On Debian/Ubuntu using iptables-persistent, rules are stored in /etc/iptables/rules.v4 (IPv4) and /etc/iptables/rules.v6 (IPv6). The iptables-restore command reads these files at boot. On modern systems, it's recommended to use nftables or firewalld instead of direct iptables management.

Question 12: What is the function of the `MASQUERADE` target in iptables?

Performs NAT by replacing the source IP with the outgoing interface's IP (Correct answer)
Hides the destination IP address from external hosts
Blocks all masquerade traffic
Logs packets before forwarding them

Correct answer: Performs NAT by replacing the source IP with the outgoing interface's IP

MASQUERADE is used in the POSTROUTING chain for NAT, dynamically replacing source IPs with the interface's current IP — useful when the external IP is dynamic.

MASQUERADE is similar to SNAT (Source NAT) but automatically uses the IP address of the outgoing interface, making it suitable for dynamic IP addresses (e.g., DHCP from ISP). Example: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE. For static IPs, SNAT with --to-source is more efficient since it doesn't need to look up the interface IP for every packet. Both are commonly used to allow LAN clients to share a single internet connection.

Question 13: Which iptables option inserts a rule at the beginning of a chain rather than appending it to the end?

-I (Correct answer)
-A
-P
-R

Correct answer: -I

-I inserts a rule at the specified position (default position 1, the top), while -A appends to the end of the chain.

iptables -I INPUT 1 -s 10.0.0.0/8 -j ACCEPT inserts an ACCEPT rule at position 1 of the INPUT chain, before any existing rules. This is important because iptables evaluates rules sequentially — a DROP rule earlier in the chain will prevent later ACCEPT rules from being reached. Use iptables -L --line-numbers to see current positions, then -I <chain> <number> to insert at a specific position.

Question 14: What does the `fail2ban` service do on a Linux system?

Bans IPs that show malicious signs like repeated failed logins (Correct answer)
Manages firewall zones dynamically
Monitors disk failures and alerts administrators
Provides VPN tunneling for secure connections

Correct answer: Bans IPs that show malicious signs like repeated failed logins

fail2ban monitors log files for patterns (like failed SSH login attempts) and automatically adds iptables/firewalld rules to ban offending IPs temporarily.

fail2ban reads log files (auth.log, secure, etc.) and looks for configurable patterns indicating brute-force attacks. When an IP exceeds a threshold of failures within a time window, fail2ban adds a temporary ban using iptables or nftables. Configuration is in /etc/fail2ban/ with jail.conf/jail.local defining services to protect. It supports SSH, Apache, nginx, FTP, and many other services. Common tuning: set bantime (duration), findtime (window), and maxretry (threshold).

Question 15: What is the default policy setting approach in a secure Linux firewall configuration?

Default DENY on INPUT and FORWARD, default ALLOW on OUTPUT (Correct answer)
Default ALLOW on all chains
Default DENY on all chains
Default ALLOW on INPUT, DENY on OUTPUT

Correct answer: Default DENY on INPUT and FORWARD, default ALLOW on OUTPUT

A secure firewall denies all inbound and forwarded traffic by default, only allowing explicitly permitted services, while permitting outbound traffic by default.

The principle of least privilege applies to firewall design: deny all inbound traffic (INPUT chain policy DROP) and forward traffic (FORWARD chain policy DROP), then explicitly allow only needed services. The OUTPUT chain is often set to ACCEPT as outbound traffic from the local system is generally trusted, though hardened systems also restrict output. Set default policies with: iptables -P INPUT DROP; iptables -P FORWARD DROP; iptables -P OUTPUT ACCEPT.

Question 16: Which command tests whether a specific port is open on a remote host from the command line?

nc -zv host 443 (Correct answer)
ping host:443
traceroute host 443
dig host 443

Correct answer: nc -zv host 443

nc (netcat) with -z (zero I/O mode for scanning) and -v (verbose) tests if a TCP port is open without sending data.

nc -zv hostname 443 attempts a TCP connection to port 443 and reports if it's open or refused. For UDP scanning use -zu. Other tools for port testing: telnet hostname 443 (shows connection or failure), nmap -p 443 hostname (full port scanner), curl -v telnet://hostname:443 (raw TCP), or bash's built-in /dev/tcp: echo '' > /dev/tcp/hostname/443. For comprehensive scanning, nmap provides OS detection, service version, and scripting capabilities.

Question 17: What is the purpose of TCP wrappers (hosts.allow / hosts.deny) in Linux?

Control access to services by matching hostnames or IPs against allow/deny lists (Correct answer)
Encrypt TCP connections between hosts
Monitor TCP connection counts per service
Route TCP traffic based on service type

Correct answer: Control access to services by matching hostnames or IPs against allow/deny lists

TCP wrappers use /etc/hosts.allow and /etc/hosts.deny to control which hosts can connect to services compiled with libwrap support.

/etc/hosts.allow is checked first — if a match is found, access is granted. /etc/hosts.deny is checked next — if matched, access is denied. If no match in either file, access is allowed. Example hosts.allow: 'sshd: 192.168.1.0/24'. Example hosts.deny: 'ALL: ALL'. TCP wrappers add a logging layer and work with services like sshd, vsftpd, and others linked against libwrap. They're considered legacy on modern systems where firewalld/iptables are preferred.

Question 18: Which nftables table type handles both IPv4 and IPv6 traffic in a single ruleset?

inet (Correct answer)
ip
ip6
bridge

Correct answer: inet

The inet table family handles both IPv4 and IPv6, allowing a single, unified ruleset instead of separate ip and ip6 tables.

nftables supports multiple address families: ip (IPv4 only), ip6 (IPv6 only), inet (both IPv4 and IPv6), arp (ARP), bridge (bridged traffic), and netdev (device-level). Using inet allows writing rules once that apply to both protocol versions: nft add table inet filter; nft add chain inet filter input. This is a major advantage over iptables where separate ip4tables and ip6tables commands were needed for dual-stack filtering.

Question 19: What does `iptables -F` do?

Flushes (deletes) all rules from all chains in the filter table (Correct answer)
Sets default policies to ACCEPT on all chains
Saves current rules to a file
Reloads firewall rules from disk

Correct answer: Flushes (deletes) all rules from all chains in the filter table

-F (flush) removes all rules from the specified chain or all chains if none specified, but does not change default policies.

iptables -F flushes all rules in the filter table. iptables -F INPUT flushes only the INPUT chain. Note: -F does NOT reset default policies — if your default policy is DROP, flushing rules leaves you with DROP on everything (potentially locking you out via SSH). For a complete reset: iptables -F; iptables -X (delete custom chains); iptables -Z (zero counters); iptables -P INPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -P OUTPUT ACCEPT.

Question 20: Which iptables table is used for Network Address Translation (NAT)?

nat (Correct answer)
filter
mangle
raw

Correct answer: nat

The nat table handles NAT operations including SNAT, DNAT, and MASQUERADE in the PREROUTING and POSTROUTING chains.

iptables has four built-in tables: filter (default, packet filtering), nat (NAT operations), mangle (packet modification, TTL changes), and raw (connection tracking bypass). The nat table has PREROUTING (DNAT — change destination before routing), POSTROUTING (SNAT/MASQUERADE — change source after routing), and OUTPUT (NAT for locally-generated packets). Access with iptables -t nat -L to list NAT rules.

Question 21: How do you configure firewalld to add a service (e.g., http) to a zone permanently?

firewall-cmd --zone=public --add-service=http --permanent (Correct answer)
firewall-cmd --add=http --zone=public --save
firewall-cmd --zone=public --service=http --permanent
firewall-cmd --enable=http --zone=public

Correct answer: firewall-cmd --zone=public --add-service=http --permanent

The --add-service flag with a service name and --permanent persists the rule. firewalld has predefined service definitions for common services like http, https, ssh, etc.

firewalld service definitions are XML files in /usr/lib/firewalld/services/ that define port(s) and protocols for named services. Using service names instead of port numbers makes rules more readable and maintainable. After --permanent changes, run firewall-cmd --reload. Custom services can be created in /etc/firewalld/services/. List available services with: firewall-cmd --get-services. Check active services in a zone: firewall-cmd --zone=public --list-services.

Question 22: What is the role of SELinux in Linux network security?

Provides mandatory access controls that restrict what processes can do, including network operations (Correct answer)
Acts as a firewall for incoming connections
Encrypts all network traffic automatically
Manages user authentication for network services

Correct answer: Provides mandatory access controls that restrict what processes can do, including network operations

SELinux enforces mandatory access control (MAC) policies that restrict processes to specific network operations, even overriding DAC permissions.

SELinux assigns security labels (contexts) to processes, files, ports, and sockets. Even if a process has filesystem permission to bind to a port, SELinux policies may deny it unless the port type matches the process's security context. For example, httpd can only bind to http_port_t labeled ports. Commands: semanage port -a -t http_port_t -p tcp 8080 (add a port to a type), sestatus (check SELinux mode), audit2allow (generate policy from denials). AppArmor serves a similar role on Debian/Ubuntu.

Question 23: Which command displays the current active connections and their states on a Linux system?

ss -tupn (Correct answer)
netstat -r
ip link show
arp -a

Correct answer: ss -tupn

ss -tupn shows all TCP and UDP connections with process names and numeric addresses, including their connection states (ESTABLISHED, LISTEN, etc.).

ss -tupn shows: -t (TCP), -u (UDP), -p (processes/PIDs), -n (numeric). Without -l (listening) it shows established connections. Add -a to show all sockets including listening. For a quick check: ss -tnp shows TCP connections with processes. The output includes local/remote addresses, ports, and connection state. This replaces netstat which is deprecated on modern Linux systems. For real-time monitoring, use 'watch ss -tnp' or tools like nethogs or iftop.

Question 24: What is a DMZ in the context of Linux network security?

A network segment between the public internet and the internal network where public-facing servers are placed (Correct answer)
A demilitarized zone where no firewall rules apply
A kernel module that disables dangerous network protocols
A special iptables chain for external traffic

Correct answer: A network segment between the public internet and the internal network where public-facing servers are placed

A DMZ (Demilitarized Zone) isolates public-facing servers (web, mail, DNS) from the internal network, limiting breach damage if those servers are compromised.

A DMZ uses two firewalls (or a single firewall with three interfaces) to create an intermediate zone. Internet traffic can reach DMZ servers, but DMZ servers have restricted access to the internal network. This way, if a web server is compromised, the attacker can't easily reach internal systems. Linux can implement a DMZ using iptables with three interfaces: external (eth0), DMZ (eth1), internal (eth2), with specific FORWARD rules controlling traffic flow between zones.

Question 25: How do you rate-limit SSH connections using iptables to prevent brute-force attacks?

iptables -A INPUT -p tcp --dport 22 -m recent --rcheck --seconds 60 --hitcount 4 -j DROP (Correct answer)
iptables -A INPUT -p tcp --dport 22 -j LIMIT --rate 4/min
iptables -A INPUT -p tcp --dport 22 --rate-limit 4 -j DROP
iptables -A INPUT -p tcp --dport 22 -m connlimit --connlimit-above 4 -j DROP

Correct answer: iptables -A INPUT -p tcp --dport 22 -m recent --rcheck --seconds 60 --hitcount 4 -j DROP

The 'recent' module tracks recent connections and drops packets from IPs that exceed the hitcount threshold within the specified time window.

Rate limiting SSH typically uses the 'recent' module: first add IPs to a list on new connections, then drop if they exceed the threshold. Full example: iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set; iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --rcheck --seconds 60 --hitcount 4 -j DROP. The 'limit' module (-m limit) provides token-bucket rate limiting for all traffic, while 'connlimit' limits concurrent connections per IP.

Question 26: What does enabling IP forwarding do on a Linux system?

Allows the kernel to route packets between network interfaces, enabling router functionality (Correct answer)
Forces all traffic through a proxy server
Enables ICMP forwarding only
Allows users to forward their email

Correct answer: Allows the kernel to route packets between network interfaces, enabling router functionality

IP forwarding allows a Linux host to act as a router, passing packets between its network interfaces rather than discarding non-local packets.

IP forwarding is disabled by default. Enable temporarily: echo 1 > /proc/sys/net/ipv4/ip_forward or sysctl -w net.ipv4.ip_forward=1. Make permanent in /etc/sysctl.conf: net.ipv4.ip_forward = 1. For IPv6: net.ipv6.conf.all.forwarding = 1. Once enabled, combined with iptables MASQUERADE or SNAT rules, a Linux system can act as a NAT router/gateway for other machines. This is also required for container networking (Docker, Kubernetes) and VPN setups.

Question 27: Which command shows the current firewalld zones and the interfaces assigned to each?

firewall-cmd --get-active-zones (Correct answer)
firewall-cmd --list-zones
firewall-cmd --show-zones
firewall-cmd --zones --active

Correct answer: firewall-cmd --get-active-zones

--get-active-zones shows only the zones that have at least one interface or source assigned, along with which interfaces/sources belong to each zone.

firewall-cmd --get-active-zones shows only zones that are actively used (have interfaces assigned), while --get-zones lists all available zone names. To see full details of a zone: firewall-cmd --zone=public --list-all. To change an interface's zone: firewall-cmd --zone=trusted --change-interface=eth1. Zone assignment can be permanent via NetworkManager or in /etc/firewalld/zones/. The default zone for interfaces not explicitly assigned is typically 'public'.

Question 28: What is the purpose of the `tcpdump` tool in Linux network security?

Captures and analyzes network packets in real time (Correct answer)
Tests TCP connection speeds
Dumps network interface configuration
Monitors TCP connection states in the kernel

Correct answer: Captures and analyzes network packets in real time

tcpdump is a packet capture tool that intercepts and displays network traffic, essential for troubleshooting and security analysis.

tcpdump captures packets on a network interface and displays/saves them. Common usage: tcpdump -i eth0 -n port 80 (capture HTTP on eth0), tcpdump -w capture.pcap (save to file for Wireshark analysis), tcpdump host 10.0.0.1 and port 22 (filter by host and port). For security, it can detect ARP poisoning, port scans, unencrypted credential transmission, and anomalous traffic patterns. Requires root or CAP_NET_RAW capability. Wireshark provides a GUI alternative with deeper protocol analysis.

Question 29: What does the `--reject-with icmp-host-prohibited` option do in iptables?

Sends an ICMP host-prohibited message to the sender when rejecting a packet (Correct answer)
Blocks all ICMP traffic from the host
Prohibits the host from sending ICMP messages
Silently drops packets while logging them

Correct answer: Sends an ICMP host-prohibited message to the sender when rejecting a packet

This REJECT target option sends an ICMP type 3 (destination unreachable), code 10 (host administratively prohibited) message back to the sender.

REJECT with --reject-with sends an informative error to the connecting party. Options include icmp-host-prohibited, icmp-port-unreachable, icmp-net-prohibited, icmp-host-unreachable, tcp-reset, and more. icmp-host-prohibited tells the sender that the host exists but access is administratively blocked. tcp-reset sends a TCP RST for TCP connections, causing immediate connection failure. firewalld uses REJECT with icmp-host-prohibited as the default REJECT action in many of its predefined rules.

Question 30: Which file contains SELinux boolean settings that affect network service behavior?

SELinux booleans managed with getsebool/setsebool commands, stored in kernel policy (Correct answer)
The /etc/selinux/config file
The /proc/sys/selinux/ directory
The /etc/sysconfig/selinux file

Correct answer: SELinux booleans managed with getsebool/setsebool commands, stored in kernel policy

SELinux booleans are part of the kernel policy and managed with getsebool -a (list all), setsebool (set), and semanage boolean (make permanent).

SELinux booleans are named policy switches. Network-related examples: httpd_can_network_connect (allow Apache to make network connections), httpd_can_connect_ftp (allow Apache FTP connections), ftp_home_dir (allow FTP access to home dirs). View all: getsebool -a | grep httpd. Enable temporarily: setsebool httpd_can_network_connect on. Make permanent: setsebool -P httpd_can_network_connect on. The -P flag writes to policy making it survive reboots. Booleans are a safe way to customize SELinux behavior without writing custom policies.

Question 31: What is the function of the `knockd` daemon in Linux security?

Implements port knocking to hide services until a correct sequence of connection attempts is made (Correct answer)
Monitors for and blocks network knock attacks
Rotates firewall rules on a schedule
Provides knock-based authentication for VPN access

Correct answer: Implements port knocking to hide services until a correct sequence of connection attempts is made

knockd enables port knocking: a service (like SSH) is firewalled until a client 'knocks' on specific ports in sequence, then the firewall rule is dynamically opened.

Port knocking hides services from port scans. knockd monitors firewall logs for specific port sequences (e.g., 7000, 8000, 9000 TCP). When a client connects to these ports in order, knockd runs a command to open the actual service port. Configuration in /etc/knockd.conf defines sequences and commands. This prevents SSH from being visible to scanners and reduces brute-force attack surface. Security depends on keeping the sequence secret. Single Packet Authorization (SPA) with fwknop is a more secure evolution of this concept.

Question 32: Which option in sshd_config restricts which users can log in via SSH?

AllowUsers (Correct answer)
PermitUsers
ValidUsers
AcceptUsers

Correct answer: AllowUsers

AllowUsers in /etc/ssh/sshd_config specifies a whitelist of users (space-separated) who are permitted to log in via SSH.

AllowUsers user1 user2 in sshd_config permits only listed users. Related directives: AllowGroups (allow by group), DenyUsers, DenyGroups. Processing order: DenyUsers, AllowUsers, DenyGroups, AllowGroups — if any match, access is controlled accordingly. Other important sshd security settings: PermitRootLogin no (disable root login), PasswordAuthentication no (keys only), MaxAuthTries 3 (limit attempts), Port 2222 (change default port), ListenAddress (bind to specific IP). Always test changes with 'sshd -t' before restarting.

Question 33: What does the `iptables -t nat -A PREROUTING` command affect?

Packets before the routing decision is made, typically used for Destination NAT (DNAT) (Correct answer)
Packets after they have been routed, for source address translation
Only locally generated packets being sent out
All forwarded packets after routing

Correct answer: Packets before the routing decision is made, typically used for Destination NAT (DNAT)

PREROUTING in the nat table is used for DNAT — redirecting traffic destined for one address/port to another before the routing decision.

DNAT in PREROUTING is used to: redirect a public IP to a private server (port forwarding), redirect port 80 to 8080, intercept DNS (DNS redirection). Example: iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.100:8080. After DNAT, the routing decision uses the new destination IP. POSTROUTING (MASQUERADE/SNAT) handles the return path. For pure port redirects on the local machine, use REDIRECT instead of DNAT.

Question 34: How do you check if a specific port is blocked by the Linux firewall without external tools?

Using bash's /dev/tcp pseudo-device: echo > /dev/tcp/localhost/port (Correct answer)
cat /proc/net/firewall
ls /etc/firewall/ports
sysctl net.ipv4.ports.blocked

Correct answer: Using bash's /dev/tcp pseudo-device: echo > /dev/tcp/localhost/port

Bash's built-in /dev/tcp allows testing TCP connections — if the connection fails it's likely blocked, if it succeeds or shows 'connection refused' the port is reachable.

Bash's /dev/tcp pseudo-device: (echo > /dev/tcp/localhost/80) 2>&1 && echo 'port open' || echo 'port closed/blocked'. A 'Connection refused' error means the port is reachable (firewall passed it) but no service is listening. A timeout means the firewall is DROPing packets. A 'Connection refused' immediately is an REJECT or closed port. This is useful on minimal systems without nc, nmap, or telnet. For checking from outside, use: timeout 3 bash -c '</dev/tcp/remote-host/port' 2>&1.

Question 35: What is the purpose of the `iptables -m limit --limit 5/min` module?

Limits the rate of packet matching to 5 per minute using a token bucket algorithm (Correct answer)
Drops exactly 5 packets per minute from matching flows
Allows only 5 concurrent connections per minute
Sets the connection timeout to 5 minutes

Correct answer: Limits the rate of packet matching to 5 per minute using a token bucket algorithm

The limit module uses a token bucket to rate-limit rule matching, often used to prevent log flooding or rate-limit ICMP/SYN packets.

The limit module is commonly used with LOG to prevent log flooding: iptables -A INPUT -p icmp -m limit --limit 5/min -j LOG --log-prefix 'ICMP: '. It can also rate-limit connections: iptables -A INPUT -p tcp --dport 22 -m limit --limit 3/min --limit-burst 5 -j ACCEPT drops SSH connections beyond 3/min after an initial burst of 5. The token bucket refills at --limit rate, with --limit-burst being the maximum bucket size. This differs from connlimit (concurrent connections) and recent (per-IP tracking).

Question 36: Which command enables a firewalld 'rich rule' to block traffic from a specific source?

firewall-cmd --add-rich-rule='rule family=ipv4 source address=203.0.113.0/24 drop' (Correct answer)
firewall-cmd --block-source=203.0.113.0/24
firewall-cmd --add-rule='source 203.0.113.0/24 drop'
firewall-cmd --rich-rule=block --source=203.0.113.0/24

Correct answer: firewall-cmd --add-rich-rule='rule family=ipv4 source address=203.0.113.0/24 drop'

Rich rules in firewalld provide more expressive rule syntax than simple port/service additions, supporting source/destination IPs, protocols, logging, and actions.

firewalld rich rules use the syntax: rule [family] [source] [destination] [service|port|protocol|...] [log] [audit] [action]. Examples: drop all IPv4 from subnet (as above), rate-limited logging: 'rule service name=ssh log prefix=SSH limit value=1/m accept', DNAT: 'rule forward-port port=80 protocol=tcp to-port=8080'. Add with --permanent for persistence and --reload to apply. Rich rules are evaluated before simple service/port rules and support both IPv4 and IPv6.

Linux Firewall and Network Security

Which command is used to list all current iptables rules in a Linux system?

🃏 LINUX Flashcards — Study This Quiz as Flip Cards →

📚 Want to go deeper? Read the Full LINUX Study Guide →