Objective: Configure Linux iptables to perform destination-port redirection using the NAT table.
The recording suggests this intended behavior:
Incoming source
Original destination port
Redirected local port
172.16.123.0/28
TCP 80
TCP 9080
All other IPv4 sources
TCP 80
TCP 8080
The second destination, 9080, comes from the candidate's terminal commands, not the fully visible task diagram. It must therefore be treated as an inferred requirement.
A crucial technical issue is rule priority: the more specific subnet rule must be evaluated before the general port-80 rule. Otherwise, the general rule captures the subnet traffic first.
Step 1: Connect to the correct Linux server.
The recording specifies host lfcs00074.
Execute:
ssh candidate@lfcs00074
This connects to the designated host on which the firewall and NAT configuration must be performed.
Step 2: Verify that iptables is available.
Execute:
sudo iptables --version
This displays the iptables version and may indicate whether the system uses the nf_tables or legacy backend.
For example:
iptables v1.8.x (nf_tables)
The actual version depends on the installed environment.
Step 3: Inspect the existing NAT configuration.
Execute:
sudo iptables -t nat -L -n -v
-t nat selects the Network Address Translation table.
-L lists rules.
-n displays numerical IP addresses and port numbers.
-v provides verbose output, including packet and byte counters.
The NAT table contains chains including PREROUTING, OUTPUT, and POSTROUTING.
For incoming connections being redirected to local services, the relevant chain is normally PREROUTING.
Step 4: Display the PREROUTING rules with line numbers.
Execute:
sudo iptables -t nat -L PREROUTING -n -v --line-numbers
This displays the order in which incoming packets encounter the NAT rules.
Also execute:
sudo iptables -t nat -S PREROUTING
The second command displays the rules in a format similar to the commands used to configure them.
Check whether there are already rules that redirect TCP port 80.
Avoid creating duplicate or contradictory rules.
Step 5: Understand the required redirection mechanism.
The Linux REDIRECT target changes the destination of a matching packet so that it is delivered to the local machine, optionally changing its destination port.
For example:
sudo iptables -t nat -A PREROUTING \
-p tcp --dport 80 \
-j REDIRECT --to-ports 8080
This redirects incoming TCP connections originally targeting port 80 to local port 8080.
The official iptables-extensions(8) manual confirms that REDIRECT is supported in the NAT table's PREROUTING and OUTPUT chains.
Linux manual page
Step 6: Configure the source-specific rule first.
For the inferred special handling of subnet 172.16.123.0/28, execute:
sudo iptables -t nat -I PREROUTING 1 \
-s 172.16.123.0/28 \
-p tcp --dport 80 \
-j REDIRECT --to-ports 9080
Option
Purpose
-t nat
Selects the NAT table
-I PREROUTING 1
Inserts the rule at position 1
-s 172.16.123.0/28
Matches packets originating from that subnet
-p tcp
Matches TCP traffic
--dport 80
Matches original destination port 80
-j REDIRECT
Redirects the packet to the local machine
--to-ports 9080
Changes the destination port to 9080
The -I PREROUTING 1 option is important because it places the specific rule at the beginning of the chain, ahead of broader rules appended later.
Do not run this command if an equivalent correct rule already exists; inspect and reconcile the existing configuration first.
Step 7: Configure the general port redirection.
Provided an equivalent general rule is not already present, execute:
sudo iptables -t nat -A PREROUTING \
-p tcp --dport 80 \
-j REDIRECT --to-ports 8080
This handles incoming TCP port-80 connections that did not match an earlier terminating rule.
Because the source-specific rule has higher priority, the expected behavior is:
Connections from 172.16.123.0/28 are redirected to 9080.
Other incoming TCP port-80 connections are redirected to 8080.
The general rule does not require a source restriction because it is the fallback rule.
Step 8: Understand why the rule order matters.
The candidate initially enters the broad redirect to 8080 and later adds the subnet-specific redirect to 9080.
That sequence is problematic.
Consider these two rules in this order:
sudo iptables -t nat -A PREROUTING \
-p tcp --dport 80 \
-j REDIRECT --to-ports 8080
sudo iptables -t nat -A PREROUTING \
-s 172.16.123.0/28 \
-p tcp --dport 80 \
-j REDIRECT --to-ports 9080
The first rule matches all incoming TCP port-80 connections, including those from the special subnet.
Since a REDIRECT target terminates further rule evaluation for that NAT decision, the later subnet rule will not receive those matching connections.
Correct order:
Rule 1: Subnet 172.16.123.0/28 → Port 9080
Rule 2: Other TCP port-80 connections → Port 8080
The Linux iptables manual documents sequential rule evaluation and matching behavior.
Linux manual page
Step 9: Verify the configured NAT rules.
Execute:
sudo iptables -t nat -L PREROUTING \
-n -v --line-numbers
The relevant rule sequence should resemble:
1 REDIRECT tcp -- 172.16.123.0/28 0.0.0.0/0 tcp dpt:80 redir ports 9080
2 REDIRECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 redir ports 8080
The output format may vary.
If existing unrelated rules are present, preserve them. The two example lines do not imply that the real NAT table should contain only two rules.
Step 10: Correct any incorrectly ordered rules.
If the general port-80 rule is already first, the specific rule can be inserted ahead of it using:
sudo iptables -t nat -I PREROUTING 1 \
-s 172.16.123.0/28 \
-p tcp --dport 80 \
-j REDIRECT --to-ports 9080
Before doing so, make sure an identical subnet rule is not already present.
If the previous candidate commands created duplicate entries, list the chain:
sudo iptables -t nat -L PREROUTING -n --line-numbers
Then carefully remove only confirmed duplicate or erroneous entries by their current rule number:
sudo iptables -t nat -D PREROUTING RULE_NUMBER
Replace RULE_NUMBER with the actual displayed number.
Rule numbers can change after each deletion, so inspect the chain again before deleting another entry.
Do not flush the entire NAT table.
Step 11: Verify that the destination services are available.
Execute:
sudo ss -ltnp
To examine the relevant ports:
sudo ss -ltnp | grep -E ':(8080|9080)\b'
This checks whether processes are listening on TCP ports 8080 and 9080.
The iptables rules may be syntactically correct even if no service is currently listening. However, actual connection delivery requires an appropriate local service and any necessary firewall permission.
A NAT redirection rule does not automatically start the destination application.
Step 12: Check whether filtering rules permit redirected connections.
Execute:
sudo iptables -L INPUT -n -v
Check whether the existing INPUT chain allows connections to the effective destination ports.
The REDIRECT target changes the packet's destination, but a restrictive filter policy can still block delivery.
Do not add broad ACCEPT rules unless the actual task requires them and the existing firewall policy warrants the change.
Step 13: Test traffic from the specified subnet.
From a machine whose source address belongs to:
172.16.123.0/28
Initiate a fresh TCP connection to port 80 on the appropriate IP address of lfcs00074.
For an HTTP-based service, a test could use:
curl -v http://SERVER_IP:80/
Replace SERVER_IP with the real server address.
If the inferred subnet-specific rule is correct, the connection should reach the local service listening on port 9080.
A destination service's response or a packet trace can establish which port received the connection.
Step 14: Test traffic from outside the specified subnet.
From a client outside 172.16.123.0/28, initiate another new connection to the same server's TCP port 80.
The general rule should redirect that traffic to port 8080, provided no earlier rule intercepts it.
Do not rely only on a test from:
curl http://localhost:80
Locally generated traffic traverses the NAT OUTPUT chain rather than the incoming PREROUTING chain. It is therefore not a valid test of these PREROUTING rules.
Step 15: Inspect rule counters.
Execute:
sudo iptables -t nat -L PREROUTING \
-n -v --line-numbers
Review the packet and byte counters.
New matching connections should increment the applicable rule's counters.
Because NAT decisions are generally made for the initial packets of tracked connections, established connections may not increment counters in the way ordinary filter-chain traffic does.
Use fresh connections for testing.
Step 16: Preserve the rules if persistence is required.
The video shows the candidate using:
sudo service netfilter-persistent save
For a system with the appropriate netfilter-persistent plugins installed, the documented command is:
sudo netfilter-persistent save
This saves the active firewall rules through the installed persistence plugins.
Ubuntu's netfilter-persistent(8) manual documents the save operation.
Ubuntu Manpages
Before relying on it, check that the service and IPv4 plugin are installed:
command -v netfilter-persistent
ls -l /usr/share/netfilter-persistent/plugins.d/
If persistence is required, verify the saved IPv4 rules:
sudo grep -A 20 '^\*nat' /etc/iptables/rules.v4
The saved configuration should contain the correctly ordered rules.
Persistence is not explicitly visible in the task statement, so treat it as an additional measure suggested by the recorded candidate actions, not a proven requirement.
Step 17: Perform final verification.
Execute:
sudo iptables -t nat -S PREROUTING
sudo iptables -t nat -L PREROUTING -n -v --line-numbers
sudo ss -ltnp | grep -E ':(8080|9080)\b'
For the inferred two-rule requirement, the expected configuration is:
Verification
Expected behavior
Source subnet
172.16.123.0/28
Original destination
TCP port 80
Special-subnet destination
TCP port 9080
General destination
TCP port 8080
Specific rule priority
Before general rule
NAT table
nat
NAT chain
PREROUTING
Existing unrelated rules
Preserved
Final Solution
For the two redirection paths inferred from the recording, and assuming equivalent rules do not already exist, the essential command sequence is:
# Connect to the required server
ssh candidate@lfcs00074
# Inspect existing NAT rules
sudo iptables -t nat -S PREROUTING
# Specific subnet: TCP 80 → 9080
# This rule must have higher priority.
sudo iptables -t nat -I PREROUTING 1 \
-s 172.16.123.0/28 \
-p tcp --dport 80 \
-j REDIRECT --to-ports 9080
# General traffic: TCP 80 → 8080
sudo iptables -t nat -A PREROUTING \
-p tcp --dport 80 \
-j REDIRECT --to-ports 8080
# Verify rule ordering and counters
sudo iptables -t nat -L PREROUTING \
-n -v --line-numbers
# If persistence is required and configured
sudo netfilter-persistent save
Technical Verification and References
Linux iptables(8)
— Documents rule insertion, ordering, matching and chain operations.
Linux iptables-extensions(8)
— Defines the REDIRECT target and --to-ports option.
Ubuntu netfilter-persistent(8)
— Documents saving and restoring firewall rules.
Video verification finding: The candidate's commands reveal an attempted redirect from port 80 to 8080 and a separate source-specific redirect from port 80 to 9080. The specific rule was appended after the general rule, which would prevent the special-subnet redirect from taking effect as intended. The corrected sequence places the specific rule first.
Verification limitation: The full task diagram is never visible, so the inferred two-rule interpretation cannot be certified as the exact complete exam requirement. The command syntax and priority correction are validated against Linux documentation, but the final intended behavior requires the missing diagram portion and runtime connection tests.
next please
Worked for 3m 12s
