CompTIA Server+ SK0-005 Practice Question
After a recent hardening change, users outside the data-center cannot reach a CentOS 9 web server over HTTPS. You confirm that Nginx is listening locally on TCP 443 and that DNS and ICMP work. The console output of iptables -S INPUT (shown in rule-processing order) is:
-P INPUT DROP
-I INPUT 1 -j DROP
-A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT
-A INPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT
Which firewall misconfiguration is blocking the traffic, and what change will restore connectivity while keeping the server locked down?
The OUTPUT chain's default policy is DROP, preventing the server's TLS responses; change the OUTPUT policy to ACCEPT.
A generic DROP rule is placed before the port-443 allow rule; delete it or move it to the bottom so the specific ACCEPT rules are evaluated first.
The port-443 rule allows only NEW packets; replace the state check so ESTABLISHED,RELATED packets are permitted.
NAT masquerading is missing on interface eth0; add a POSTROUTING MASQUERADE rule so return packets are translated.