CompTIA Linux+ XK0-006 (V8) Practice Question

The rule is appended to the nat table's PREROUTING chain and uses the DNAT target. In this chain, packets are processed before the routing decision, so changing their destination here causes the kernel to deliver them to the new address. Any TCP packet that arrives on eth0 with destination port 8443 has its destination address and port rewritten to 192.168.20.15:443. The packet is then routed toward that internal host, allowing the firewall to forward external connections on port 8443 to the web service running on port 443 inside the LAN.

No source address translation occurs, so options describing masquerading or SNAT are incorrect. Likewise, a REDIRECT action would send the traffic to a local port on the firewall itself, which the rule does not specify. Therefore, only the statement that the rule forwards incoming 8443/TCP traffic on eth0 to 192.168.20.15:443 is correct.