LPIC-2 Advanced Networking Configuration Practice Question
A company has a Linux server with two network interfaces: eth0 connected to the internal 192.168.1.0/24 network, and eth1 connected to the internet via a public IP of 203.0.113.10. The server runs a web server on port 80 and needs to allow internal clients to access the internet while hiding their private IPs (MASQUERADE). Additionally, external users should be able to reach the web server using the public IP. The administrator has enabled IP forwarding and configured iptables with the following rules:
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
However, internal clients can access the internet, but external users cannot reach the web server. What should the administrator do to fix the issue?
⚠ Common exam trap
Candidates often confuse the need for DNAT with simply opening firewall rules (INPUT or FORWARD), forgetting that without destination address translation, the internal server never sees the packet as destined for itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a DNAT rule in the PREROUTING chain of the nat table to translate destination 203.0.113.10:80 to 192.168.1.100:80.
The current iptables rules perform SNAT/MASQUERADE for outbound traffic and allow forwarding of related/established inbound traffic, but they do not redirect incoming connections destined for the public IP (203.0.113.10:80) to the internal web server (e.g., 192.168.1.100:80). A DNAT rule in the PREROUTING chain of the nat table is required to translate the destination address and port, so that external packets are forwarded to the internal server and the response traffic is handled by the existing MASQUERADE rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add a DNAT rule in the PREROUTING chain of the nat table to translate destination 203.0.113.10:80 to 192.168.1.100:80.
Why this is correct
This will redirect incoming packets to the internal web server.
- ✗
Add a FORWARD rule to allow new connections from eth1 to eth0.
Why it's wrong here
The FORWARD rules already allow related/established; a DNAT is needed for new connections.
- ✗
Add a rule in the INPUT chain to accept traffic on port 80.
Why it's wrong here
INPUT chain handles traffic destined to the server itself, not forwarded traffic.
- ✗
Change the MASQUERADE rule to SNAT with the public IP.
Why it's wrong here
MASQUERADE is fine for outbound traffic; the issue is inbound.
Visual reference
Go deeper
Related to this question
About these practice questions
This LPIC-2 question is part of Courseiva's 507-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.