Skip to content
LFCSNetworkingSingle Linux VMHard

Packet filtering, port redirection and NAT with nftables

Scenario lfcs-net-004 · about 8 minutes · 9 points · 8 grader checks

Write a persistent nftables ruleset with a default-drop input chain, a port redirect and source NAT, and track down an unexpected listener.

  • nftables
  • firewall
  • nat
  • port-redirection
  • ss
  • troubleshooting

What you will practise

  • Write an nftables filter chain with a drop policy
  • Redirect a port for incoming and local traffic
  • Masquerade a source network
  • Find which service owns a listening socket

Start this lab

With the CLI installed and signed in, this command provisions a fresh Ubuntu 24.04 LTS virtual machine on your Mac, applies the scenario setup and prints the task below.

goldenkube start lfcs-net-004

Task

The task text exactly as the CLI shows it. Solve it on the machine, then run goldenkube submit.

nginx serves a test page on port 80 of this host. 1. Create a persistent nftables ruleset in /etc/nftables.conf, loaded at boot by nftables.service: - table inet labfilter, chain input (hook input, policy drop) that accepts loopback traffic, established and related connections, ICMP and ICMPv6, DHCP replies (UDP to port 68), and new TCP connections to ports 22 and 80. Nothing else is accepted. - table ip labnat with - chain prerouting (nat, hook prerouting) and chain output (nat, hook output) that redirect TCP port 8080 to port 80 on this host (so http://127.0.0.1:8080/ shows the nginx page) - chain postrouting (nat, hook postrouting) that masquerades traffic from 10.20.30.0/24. Keep TCP 22 open: losing SSH ends the lab. 2. Something is listening on TCP port 4444. Find the systemd unit that owns that socket, write the unit name (for example name.service) to /root/port-4444.txt, then stop and disable that unit.

Requirements and details

Certification
LFCS · Linux Foundation Certified System Administrator
Domain
Networking
Difficulty
Hard
Environment
Single Linux VM
Recommended time
8 minutes
Points
9
Grader checks
8
Operating system
Ubuntu 24.04 LTS
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 8 state checks read your machine when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Networking labs

LFCSNetworkingHard

Bond, bridge, IPv4/IPv6 addresses, a static route and name resolution

Build an active-backup bond and a bridge from dummy interfaces, address the bridge with IPv4 and IPv6, add a static route and a hosts entry, all persistent.

Single Linux VM · ~9 min · 9 points

  • bonding
  • bridge
  • ipv6
  • static-route
  • netplan
  • systemd-networkd
  • hosts

goldenkube start lfcs-net-001

LFCSNetworkingEasy

Time synchronisation with chrony and the time zone

Point chrony at two internal time servers only, allow a client network to query it, enable it, and set the system time zone.

Single Linux VM · ~4 min · 6 points

  • chrony
  • ntp
  • time
  • timezone
  • timedatectl

goldenkube start lfcs-net-002

LFCSNetworkingMedium

Harden the OpenSSH server and set up a client profile

Make sshd listen on two ports with key-only logins limited to one group, then give a user a key pair and a host alias that works without prompts.

Single Linux VM · ~7 min · 8 points

  • openssh
  • sshd
  • ssh-keys
  • ssh-config
  • hardening

goldenkube start lfcs-net-003

LFCSNetworkingMedium

Reverse proxy and load balancer with nginx

Publish two local backends behind one nginx virtual host with round-robin balancing, the original Host header and a status path answered by nginx itself.

Single Linux VM · ~6 min · 7 points

  • nginx
  • reverse-proxy
  • load-balancing
  • upstream
  • http

goldenkube start lfcs-net-005

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.