Exam MTCNA Topic 2 Question 151 Discussion

The key requirement is to block traffic from LAN1 to the internal server at 192.168.1.10. Given that R1 uses masquerade (srcnat), all packets arriving at R2 from LAN1 will appear as if they come from R1's IP (192.168.99.1). Therefore, filtering by the original IP (LAN1 clients like 192.168.0.x) won't work unless you stop the traffic before it's NATed.
So the correct way is to drop the packets before they reach the server by identifying the original subnet (LAN1), which is 192.168.0.0/24, in the forward chain.
* A. Wrong: You're filtering based on the post-NAT address (192.168.99.1), not the source LAN subnet.
* B. Correct: Block traffic coming from 192.168.0.0/24 (LAN1) before it hits the NAT rule.#
* C. Wrong chain: input is only for traffic destined to the router itself.
* D. Incorrect chain: dstnat is for translating destination IP, not filtering.
MTCNA Firewall Module - NAT and Forwarding Concepts:
"Filter before NAT to match pre-NAT source addresses. Masquerade masks real source IP." Rene Meneses MTCNA Guide - Practical Firewall Rules:
"When masquerade is applied, forward chain rules using original IP must be placed before the NAT rule." Terry Combs Notes - Firewall Filtering:
"Forward chain handles routed traffic. Use it to block routed traffic between subnets."