LPIC-2 Advanced Networking Configuration Practice Question
An administrator is configuring netfilter rules to implement a stateful firewall. Which TWO of the following commands are necessary to allow the firewall to correctly forward TCP traffic from internal to external networks (assuming proper default policies)?
⚠ Common exam trap
It's easy for candidates to think only the `ESTABLISHED` rule is needed, forgetting that `RELATED` is also required for protocols like FTP or ICMP error messages that are associated with an existing connection but are not part of the same TCP stream.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
iptables -A FORWARD -m state --state ESTABLISHED -j ACCEPT
A stateful firewall must allow packets belonging to already established connections to pass through the FORWARD chain. The `-m state --state ESTABLISHED` match ensures that any packet that is part of an existing TCP connection (i.e., has seen the three-way handshake) is accepted, which is essential for forwarding return traffic from external networks back to internal hosts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
iptables -A FORWARD -m state --state NEW -j ACCEPT
Why it's wrong here
This alone would allow all new connections without restriction, which is generally too permissive.
- ✓
iptables -A FORWARD -m state --state ESTABLISHED -j ACCEPT
Why this is correct
This allows established connections, crucial for stateful firewall.
- ✗
iptables -A FORWARD -j ACCEPT
Why it's wrong here
This would disable the firewall entirely.
- ✓
iptables -A FORWARD -m state --state RELATED -j ACCEPT
Why this is correct
This allows related traffic (e.g., FTP data), also necessary for stateful inspection.
- ✗
iptables -A FORWARD -m state --state NEW -p tcp --dport 80 -j ACCEPT
Why it's wrong here
This allows only HTTP new connections, but the question asks for necessary commands to forward TCP traffic in general; a rule for ESTABLISHED is essential.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every LPIC-2 question from scratch — 507 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.