LPIC-1 Essential System Services and Networking Practice Question
A database server on a Linux system is configured to listen on TCP port 3306. The administrator wants to restrict access to the database server to only the local network (192.168.1.0/24) using iptables. Which of the following iptables rules achieves this?
⚠ Common exam trap
A common mix-up: candidates confuse the -s (source) and -d (destination) flags, leading candidates to pick Option A which drops traffic to the local network instead of accepting traffic from it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
iptables -A INPUT -p tcp --dport 3306 -s 192.168.1.0/24 -j ACCEPT
It adds an INPUT chain rule that accepts TCP traffic destined for port 3306 only when the source address is within the 192.168.1.0/24 subnet. This effectively restricts incoming database connections to the local network, while all other sources are implicitly dropped by the default INPUT policy or subsequent rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
iptables -A INPUT -p tcp --dport 3306 -d 192.168.1.0/24 -j DROP
Why it's wrong here
The -d match with -j DROP discards traffic destined for the subnet, which is inverted: the rule must match source addresses and accept them. Correct filtering uses -s 192.168.1.0/24 with -j ACCEPT. Destination matching suits rules protecting a specific host or subnet.
- ✗
iptables -A OUTPUT -p tcp --dport 3306 -d 192.168.1.0/24 -j ACCEPT
Why it's wrong here
This matches outbound traffic leaving the host, not inbound connections reaching port 3306; the INPUT chain governs traffic destined for the local server. It is tempting because OUTPUT rules with a destination subnet are valid syntax, and would be correct for restricting which remote hosts a local client may connect to.
- ✓
iptables -A INPUT -p tcp --dport 3306 -s 192.168.1.0/24 -j ACCEPT
Why this is correct
This rule matches TCP destination port 3306 with source 192.168.1.0/24 and accepts it, restricting database access to the local subnet. Other traffic to that port falls through to subsequent rules, satisfying the stem's local-network-only constraint.
- ✗
iptables -A OUTPUT -p tcp --sport 3306 -s 192.168.1.0/24 -j ACCEPT
Why it's wrong here
Specifying --sport 3306 on OUTPUT filters replies sent from the server's source port, not incoming client connections; INPUT with --dport 3306 is required. It is tempting because source-port matching is legitimate for stateful reply filtering, and would suit rules permitting return traffic from an established database session.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every LPIC-1 question from scratch — 402 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-1 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-1 exam.