LPIC-2 Advanced Networking Configuration Practice Question
A medium-sized company uses a Linux server as its internet gateway. The server runs Ubuntu 20.04 and has two network interfaces: eth0 (IP 192.168.1.1/24) connected to the internal LAN, and eth1 (DHCP client, obtains IP 203.0.113.10/24, gateway 203.0.113.1) connected to the ISP modem. The server uses iptables for NAT with the rule 'iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE'. IP forwarding is enabled (net.ipv4.ip_forward=1). Firewalld is running with the default zone set to 'public'. For the past week, internal clients on 192.168.1.0/24 have reported intermittent connectivity to external websites. The administrator notices that during the failures, packets sent to external websites leave the internal network (tcpdump on eth1 shows SYN), but the response SYN-ACK never reaches the client. The administrator checks that the iptables FORWARD chain has a default policy of ACCEPT and no restrictive rules. Which of the following is the most likely cause?
⚠ Common exam trap
The trap here is that candidates often focus on iptables rules and forget that firewalld, when running, can override iptables policies, especially with its default zone settings that drop incoming packets on external interfaces.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall is dropping incoming packets on eth1 due to default zone settings.
Firewalld, when running with the default zone set to 'public', applies a default 'reject' or 'drop' policy for incoming traffic on interfaces assigned to that zone. Since eth1 (the external interface) is likely assigned to the public zone, incoming SYN-ACK packets (which are part of established connections) are dropped by firewalld before they can be processed by iptables. This explains why tcpdump on eth1 shows outgoing SYN packets but no incoming SYN-ACK, even though iptables FORWARD chain is permissive.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The server's routing table is missing a route back to the internal network.
Why it's wrong here
The route to 192.168.1.0/24 is via eth0, which is directly connected.
- ✗
The MASQUERADE rule is missing the source network specification.
Why it's wrong here
MASQUERADE without source specification works for all traffic.
- ✓
The firewall is dropping incoming packets on eth1 due to default zone settings.
Why this is correct
Firewalld's public zone drops incoming SYN-ACK packets.
- ✗
The default gateway on the internal clients is not set to the Linux server's internal IP.
Why it's wrong here
Clients are sending traffic, so their gateway is correct.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every LPIC-2 question from scratch — 507 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.