CompTIA Server+ SK0-005 Practice Question
After a recent hardening change, users outside the data-center cannot reach a CentOS 9 web server over HTTPS. You confirm that Nginx is listening locally on TCP 443 and that DNS and ICMP work. The console output of iptables -S INPUT (shown in rule-processing order) is:
-P INPUT DROP
-I INPUT 1 -j DROP
-A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT
-A INPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT
Which firewall misconfiguration is blocking the traffic, and what change will restore connectivity while keeping the server locked down?
NAT masquerading is missing on interface eth0; add a POSTROUTING MASQUERADE rule so return packets are translated.
The OUTPUT chain's default policy is DROP, preventing the server's TLS responses; change the OUTPUT policy to ACCEPT.
The port-443 rule allows only NEW packets; replace the state check so ESTABLISHED,RELATED packets are permitted.
A generic DROP rule is placed before the port-443 allow rule; delete it or move it to the bottom so the specific ACCEPT rules are evaluated first.