Linux Firewall and Network Security 2 — Questions and Answers
Question 1: Which iptables table is responsible for altering packet headers such as TTL and TOS fields?
- filter
- nat
- mangle (Correct answer)
- raw
Correct answer: mangle
The mangle table is used to modify packet headers, including TTL, TOS, and MARK fields.
Question 2: What nftables command lists all current rules across all tables and chains?
- nft show rules
- nft list ruleset (Correct answer)
- nft dump all
- nft display tables
Correct answer: nft list ruleset
'nft list ruleset' outputs the complete nftables configuration including all tables, chains, and rules.
Question 3: Which firewalld zone is most restrictive and drops all incoming connections without any notification?
- block
- drop (Correct answer)
- reject
- internal
Correct answer: drop
The 'drop' zone silently discards all incoming packets, while 'block' sends an ICMP rejection message.
Question 4: In iptables, what does the '-j RETURN' target do when used inside a user-defined chain?
- Drops the packet immediately
- Returns to the calling chain and continues matching (Correct answer)
- Accepts the packet unconditionally
- Logs the packet and drops it
Correct answer: Returns to the calling chain and continues matching
RETURN exits the current user-defined chain and resumes rule matching in the parent chain that invoked it.
Question 5: Which command adds a permanent firewalld service rule to the public zone without applying it immediately?
- firewall-cmd --zone=public --add-service=http --permanent (Correct answer)
- firewall-cmd --zone=public --add-service=http
- firewall-cmd --permanent --zone=public --enable=http
- firewall-cmd --zone=public --service=http --save
Correct answer: firewall-cmd --zone=public --add-service=http --permanent
The --permanent flag writes the rule to the persistent configuration but requires --reload to take effect at runtime.
Question 6: What is the purpose of the 'conntrack' module in Linux netfilter?
- Counts total packet throughput
- Tracks connection state for stateful filtering (Correct answer)
- Monitors network interface bandwidth
- Blocks connection attempts from blacklisted IPs
Correct answer: Tracks connection state for stateful filtering
conntrack (connection tracking) maintains a state table allowing the firewall to distinguish NEW, ESTABLISHED, and RELATED connections.
Question 7: Which iptables command displays the packet and byte counters for all rules in the INPUT chain?
- iptables -L INPUT
- iptables -L INPUT -v (Correct answer)
- iptables -S INPUT
- iptables -n INPUT
Correct answer: iptables -L INPUT -v
The -v (verbose) flag adds packet and byte counters to the iptables listing output.
Linux Firewall and Network Security 2
Which iptables table is responsible for altering packet headers such as TTL and TOS fields?