LPIC-1 Essential System Services and Networking Practice Question
A Linux server acts as a router between an internal network and the internet. After enabling IPv4 forwarding, clients still cannot reach external hosts. The administrator confirms the routing table is correct and the external interface is up. Which command displays the current kernel packet-filter rules so the administrator can verify whether forwarding is being blocked?
⚠ Common exam trap
The trap here is assuming that correct routing and an up interface are sufficient for forwarding, when a packet-filter rule in the forward chain can silently drop transit traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
nft list ruleset
Forwarded packets traverse the forward path of the packet filter, so a drop or reject rule there prevents transit traffic even when routing and interface state are correct. On a host using the nftables backend, nft list ruleset dumps the entire ruleset, exposing any forward chain rules that block the traffic and allowing the administrator to confirm the cause.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ip route show
Why it's wrong here
ip route show displays the kernel routing table, listing destination networks, gateways, and interfaces. Since the scenario already states the routing table is correct, this command repeats known information and reveals nothing about packet filtering. It cannot show whether a forward chain or filter table is dropping the traffic.
- ✗
ss -tulpn
Why it's wrong here
ss lists local sockets and their listening processes, which is useful for confirming whether services are bound to ports, but it says nothing about packet filtering or the forward path. Forwarded traffic is not terminated by a local socket, so this command cannot reveal why the router is dropping transit packets.
- ✓
nft list ruleset
Why this is correct
nft list ruleset prints every table, chain, and rule in the nftables ruleset, including any forward chain that could be dropping or rejecting traffic. On a modern distribution using nftables as the packet-filter backend, this shows exactly what is filtering forwarded packets, making it the right command to diagnose blocked forwarding.
- ✗
ip -s link show
Why it's wrong here
ip -s link show reports interface statistics such as received and transmitted bytes and errors. It can hint at traffic counts but does not show firewall rules, so it cannot identify a drop rule in the forward chain. The administrator would see counters without knowing which rule or table is responsible.
Go deeper
Related to this question
About these practice questions
This LPIC-1 question is part of Courseiva's 402-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official LPI exam blueprint
This LPIC-1 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-1 exam.