LFCS Networking Practice Question
A Linux router has two interfaces: wan0 with address 198.51.100.10/24 and lan0 with address 10.10.0.1/24. Hosts on 10.10.0.0/24 can ping the router's lan0 address but cannot reach any Internet host. The administrator has already enabled net.ipv4.ip_forward=1. Which command is required to allow the internal hosts to reach external networks?
⚠ Common exam trap
The trap here is believing that enabling ip_forward or adding a FORWARD accept rule is sufficient, when private source addresses must also be translated before they can reach the Internet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -o wan0 -j MASQUERADE
Forwarding lets packets pass between interfaces, but private RFC 1918 sources cannot traverse the public Internet. The router must rewrite the source address of outbound packets to its public address, which is done with source NAT. A POSTROUTING MASQUERADE rule on the WAN interface accomplishes this dynamically, using the interface's current address, and enables return traffic to be mapped back to the correct internal host.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -o wan0 -j MASQUERADE
Why this is correct
Because the internal hosts use private addresses that are not routable on the Internet, the router must translate their source addresses to its public wan0 address. A POSTROUTING MASQUERADE rule on the outbound interface performs this source NAT, so return traffic can be de-NATed and delivered back to the internal hosts.
- ✗
iptables -A FORWARD -i lan0 -o wan0 -j ACCEPT
Why it's wrong here
A FORWARD accept rule permits packets to traverse the router but leaves their private source addresses unchanged. Internet routers will drop or fail to return packets with 10.10.0.0/24 sources, so forwarding alone cannot provide connectivity; address translation is also required.
- ✗
ip route add default via 198.51.100.1 dev lan0
Why it's wrong here
This route would send default traffic out the LAN interface toward a gateway that is not on that segment, which is invalid and would break routing. Even a correctly placed default route only handles the router's own traffic; it does not translate the private source addresses of the internal hosts, so their packets would still be unroutable.
- ✗
iptables -t nat -A PREROUTING -i wan0 -j DNAT --to-destination 10.10.0.1
Why it's wrong here
DNAT in PREROUTING rewrites the destination address of inbound packets, which is used for publishing internal services to the outside. It does nothing for outbound traffic originating from internal hosts, so it would not enable them to reach the Internet and could even break inbound connections by redirecting them to the router itself.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every LFCS question from scratch — 406 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Linux Foundation exam blueprint
This LFCS practice question is part of Courseiva's free Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LFCS exam.