I85PREP
⌘ K
LPIC-3 Security study materials
LPIC-3 Security study resources

LPIC-3 Security: Network Security

LPIC-3 Security · Work through your exam, one topic at a time.

All guide sections

Network Security

Network security tests packet filtering, stateful firewalling, secure remote access, and your ability to prove what is genuinely listening and reachable.

Core rules

  • Default-deny: DROP policies on input and forward, accept loopback, accept established/related, then permit explicit services.
  • nftables supersedes iptables: table inet filter with base chains type filter hook input priority 0; policy drop; and rules such as iif lo accept, ct state established,related accept, tcp dport {22,443} accept. Persist via /etc/nftables.conf and nft -f.
  • iptables equivalent: -P INPUT DROP, -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT, then per-service accepts; save with iptables-save or netfilter-persistent.
  • NAT: masquerade on egress, dnat for published services; both need net.ipv4.ip_forward=1.
  • SSH tunneling: -L local forward, -R remote forward, -D SOCKS proxy; restrict with PermitOpen and AllowTcpForwarding no.
  • VPNs: WireGuard (key pairs, AllowedIPs), OpenVPN (TLS certificates), IPsec; distribute keys out of band.
  • Visibility: ss -tulpn, tcpdump -ni any port 22, conntrack -L, fail2ban for brute force. TCP wrappers only affect libwrap-linked daemons.

Worked example

nft add rule inet filter input ct state established,related accept, then tcp dport 22 accept, then counter drop. Reasoning: stateful acceptance admits return traffic without opening inbound ports, and the counter on the final drop produces evidence of what is being blocked - useful when tuning rules.

Traps

Accept rules placed after a drop; forgetting loopback; testing remotely without a scheduled rollback; confusing DNAT with filter chains; running firewalld, ufw, and raw nftables rules simultaneously instead of one front end.