I85PREP
⌘ K
CUNP study materials
CUNP study resources

CUNP: Routing, Firewalling, and Traffic Control

CUNP · Work through your exam, one topic at a time.

All guide sections

Routing, Firewalling, and Traffic Control

This domain tests packet forwarding decisions, stateful filtering, NAT, and traffic shaping on Unix/Linux. CUNP questions expect you to read a routing table, place a rule in the correct nftables or iptables chain, and explain why NAT or forwarding fails.

Core rules and concepts

  • Routers use longest-prefix match. If no route matches, the packet is dropped or an ICMP unreachable is generated, depending on context.
  • Policy routing uses rules to select routing tables, enabling source-based routing or multiple uplinks.
  • Linux forwarding requires net.ipv4.ip_forward=1 for IPv4, and IPv6 forwarding is controlled separately.
  • nftables is the modern framework; iptables may be a compatibility front end. Rules live in tables and chains, with hooks such as input, forward, and output.
  • Stateful firewalls track connections with conntrack. Return traffic for an established connection is normally accepted by a state rule, not by a separate inbound rule for every port.
  • NAT changes addresses or ports. SNAT/masquerade is common for outbound sharing; DNAT redirects inbound connections. NAT is not a substitute for a forwarding rule.
  • Traffic control uses qdiscs, classes, and filters to shape, schedule, or police traffic. It affects egress scheduling most directly; ingress shaping often needs an IFB device.

Worked example

A Linux host can ping its gateway but not the internet, and it is meant to be a router. Check ip route for a default route, then sysctl net.ipv4.ip_forward. On the router, confirm the FORWARD chain accepts the flow and that masquerade or SNAT is applied on the outbound interface. Use conntrack -L to see whether replies are tracked. A common error is allowing INPUT but forgetting FORWARD, or adding NAT without enabling forwarding.

Traps that cost marks

Do not confuse INPUT with FORWARD. Do not assume NAT alone permits forwarding. Remember that conntrack state is not the same as a listening socket. Avoid changing the default policy to DROP before allowing management access. Longest-prefix match beats metric; metric only breaks ties among equally specific routes.

Exam focus

Trace route lookup, forwarding sysctl, filter chain, and NAT hook in order, then verify with counters and conntrack.