hardMultiple Choice

iptables Output Chain Default ACCEPT Security Risk

Exhibit

Refer to the exhibit.

```
# iptables -L FORWARD -v -n
Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  eth0   eth1    10.0.1.0/24          0.0.0.0/0            state NEW,ESTABLISHED
    0     0 ACCEPT     all  --  eth1   eth0    0.0.0.0/0            10.0.1.0/24          state ESTABLISHED
```

A network administrator is troubleshooting connectivity issues. Based on the exhibit, which of the following is true about the iptables rules?

⚠ Common exam trap

A common mix-up: candidates confuse the FORWARD chain with the INPUT chain, assuming that rules in the FORWARD chain apply to traffic destined for the firewall itself, or they overlook that the default policy for the FORWARD chain is DROP (not ACCEPT) unless explicitly set to ACCEPT in the exhibit.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Traffic from 10.0.1.0/24 to the internet is allowed, but return traffic is only allowed if it is part of an established connection.

The iptables rules show a default FORWARD policy of DROP (as indicated by the 'policy DROP' line), which drops all traffic not explicitly allowed. The rule '-A FORWARD -s 10.0.1.0/24 -j ACCEPT' allows outbound traffic from the 10.0.1.0/24 subnet to the internet. The rule '-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT' ensures that return traffic belonging to an existing connection is permitted back, while new inbound connections from the internet are implicitly dropped by the default DROP policy.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
New connections from the internet to 10.0.1.0/24 are allowed.
Why it's wrong here
The exhibit's rules target the firewall's own interfaces and services, so they do not govern forwarded traffic to the 10.0.1.0/24 subnet. Allowing internet-to-subnet connections requires FORWARD chain rules plus NAT or routing, which is the scenario where this statement would hold.
✗
All traffic is allowed by default because the policy is ACCEPT.
Why it's wrong here
The policy ACCEPT only sets the default for chains without a matching rule; explicit DROP or REJECT rules earlier in the chain still block matching packets. Default ACCEPT is the correct reading when a chain contains no terminating rules, so unmatched traffic passes through rather than being discarded.
✓
Traffic from 10.0.1.0/24 to the internet is allowed, but return traffic is only allowed if it is part of an established connection.
Why this is correct
The OUTPUT chain's stateful rule permits replies only when conntrack marks them ESTABLISHED or RELATED, so outbound sessions from 10.0.1.0/24 succeed while unsolicited inbound packets are dropped. This satisfies the exhibit's requirement that return traffic be tied to connections initiated internally, rather than opening the interface indiscriminately.
✗
The rules apply to incoming traffic on the firewall itself.
Why it's wrong here
Rules in the INPUT chain govern traffic destined for the firewall host itself, not traffic being forwarded to other hosts. This option would be correct if the exhibit showed rules in the FORWARD chain, which handles packets routed through the firewall to a different destination.

Visual reference

Go deeper

iptables Output Chain Default ACCEPT Security Risk

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question