Firewall basics (ufw, iptables) in Linux CLI - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

What is the output of this UFW status command?

You run the command sudo ufw status verbose on a Linux server with these rules enabled:

- Allow SSH (port 22)
- Deny all incoming by default

What will the output show?

Linux CLI

sudo ufw status verbose

A Status: inactive

B

Status: active
Logging: on (low)
Default: allow (incoming), allow (outgoing), disabled (routed)

To                         Action      From
--                         ------      ----
22                         DENY IN     Anywhere

C

Status: active
Logging: off
Default: allow (incoming), deny (outgoing), disabled (routed)

To                         Action      From
--                         ------      ----
22                         ALLOW IN    Anywhere

D

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22                         ALLOW IN    Anywhere

💡 Hint

Think about the default policies and what rules you added.

The default incoming policy is deny, outgoing is allow. SSH port 22 is allowed explicitly. Logging is on by default in verbose mode.

💻 Command Output

intermediate

What does this iptables command do?

You run this command:

sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT

What is the effect on the firewall?

Linux CLI

sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT

A It blocks all incoming TCP traffic on port 80.

B It allows incoming TCP traffic on port 80 (HTTP).

C It allows outgoing TCP traffic on port 80.

D It deletes existing rules for port 80.

💡 Hint

Look at the chain, protocol, port, and action.

The command appends a rule to the INPUT chain to accept TCP packets destined for port 80, allowing HTTP traffic in.

🔧 Debug

advanced

Why does this iptables rule cause an error?

You try to run:

sudo iptables -A INPUT -p tcp --dport ssh -j ACCEPT

But it returns an error. Why?

Linux CLI

sudo iptables -A INPUT -p tcp --dport ssh -j ACCEPT

A The chain 'INPUT' does not exist.

B The protocol 'tcp' is invalid for port 'ssh'.

C The port name 'ssh' is not recognized; port numbers must be used.

D The jump target 'ACCEPT' is misspelled.

💡 Hint

Check if iptables accepts service names or only numbers for ports.

Iptables requires numeric port numbers for --dport; 'ssh' is not recognized as a valid port number.

🚀 Application

advanced

Create a UFW rule to allow HTTPS only from a specific IP

You want to allow incoming HTTPS (port 443) traffic only from IP 192.168.1.100 using UFW.

Which command achieves this?

A sudo ufw allow from 192.168.1.100 to any port 443 proto tcp

B sudo ufw allow 443 from 192.168.1.100

C sudo ufw allow to 192.168.1.100 port 443

D sudo ufw deny from 192.168.1.100 to any port 443

💡 Hint

Think about specifying source IP, destination port, and protocol.

Option A correctly specifies source IP, destination port 443, and TCP protocol to allow HTTPS only from that IP.

🧠 Conceptual

expert

What is the effect of this iptables command sequence?

Consider these commands run in order:

1. sudo iptables -P INPUT DROP
2. sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
3. sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

What is the overall effect on incoming traffic?

A All incoming traffic is blocked except established connections and new SSH connections on port 22.

B All incoming traffic is allowed including SSH and established connections.

C All incoming traffic is blocked including SSH and established connections.

D Only SSH traffic is allowed; all other traffic is blocked.

💡 Hint

Look at the default policy and the rules allowing specific traffic.

The default policy drops all incoming packets. The rules allow packets part of existing connections and new SSH connections on port 22.