Bad argument `53'

Bad argument `53'

[David F. Strauch]

[-- Attachment #1: Type: text/plain, Size: 1154 bytes --]

Hello Everyone



By reading New Riders “Linux Firewalls” by Robert L. Ziegler I’m just starting to study iptables.  I have a stand-alone firewall offline and off the local network running RHL 7.3 with Kernel 2.4.18-3 and iptables 1.2.5.

 

I’ve just started writing the script to allow DNS Loopkups as a client with the following:

 

if [ "$CONNECTION_TRACKING" = "1" ]; then

    iptables -A OUTPUT -o $INTERNET -p udp \

             -s $IPADDR --sport $UNPRIVPORTS \

             -d $NAMESERVER --dport 53 \

             -m state --state NEW -j ACCEPT

fi

 

iptables -A OUTPUT -o $INTERNET -p udp \

         -s $IPADDR --sport $UNPRIVPORTS \

         -d $NAMESERVER --dport 53 -j ACCEPT

 

iptables -A INPUT  -i $INTERNET -p udp \

         -s $NAMESERVER --sport 53 \

         -d $IPADDR --dport $UNPRIVPORTS -j ACCEPT

 

When I execute the script with sh /etc/rc.d/rc.firewalls I receive Bad argument `53' for every instance of either  --dport 53 or --sport 53.  I’ve also tried --destination-port and --source-port with out any success.

 

Can anyone shed some light on my problem?

Dave

[-- Attachment #2: Type: text/html, Size: 6645 bytes --]

Re: Bad argument `53'

[Sundaram]

[-- Attachment #1: Type: text/plain, Size: 1728 bytes --]

I have this rules set in my  firewall, it is working for me.

$IPT -A OUTPUT -o $EXT -p tcp --sport $UNPRI --dport 53 -j ACCEPT

$IPT -t nat -A PREROUTING  -i $EXT -d $EXT_IP1  -p tcp --dport 25 -j DNAT --to $INT_IP1
$IPT -A FORWARD -p tcp  --dport 25 -d $INT_IP1 -j ACCEPT

I am also using REdhat 7.3 Kernel 2.4.18-3 and iptables 1.2.7
  ----- Original Message ----- 
  From: David F. Strauch 
  To: netfilter@lists.netfilter.org 
  Sent: Wednesday, October 09, 2002 10:17 PM
  Subject: Bad argument `53' 


  Hello Everyone



  By reading New Riders “Linux Firewalls” by Robert L. Ziegler I’m just starting to study iptables.  I have a stand-alone firewall offline and off the local network running RHL 7.3 with Kernel 2.4.18-3 and iptables 1.2.5.

   

  I’ve just started writing the script to allow DNS Loopkups as a client with the following:

   

  if [ "$CONNECTION_TRACKING" = "1" ]; then

      iptables -A OUTPUT -o $INTERNET -p udp \

               -s $IPADDR --sport $UNPRIVPORTS \

               -d $NAMESERVER --dport 53 \

               -m state --state NEW -j ACCEPT

  fi

   

  iptables -A OUTPUT -o $INTERNET -p udp \

           -s $IPADDR --sport $UNPRIVPORTS \

           -d $NAMESERVER --dport 53 -j ACCEPT

   

  iptables -A INPUT  -i $INTERNET -p udp \

           -s $NAMESERVER --sport 53 \

           -d $IPADDR --dport $UNPRIVPORTS -j ACCEPT

   

  When I execute the script with sh /etc/rc.d/rc.firewalls I receive Bad argument `53' for every instance of either  --dport 53 or --sport 53.  I’ve also tried --destination-port and --source-port with out any success.

   

  Can anyone shed some light on my problem?

  Dave

[-- Attachment #2: Type: text/html, Size: 8358 bytes --]

RE: Bad argument `53'

[Larry Flathmann]

[-- Attachment #1: Type: text/plain, Size: 3022 bytes --]

When you get an error message about a bad argument, it's usually because
something earlier in the line was missing. So, for example, in the command:
    iptables -A OUTPUT -o $INTERNET -p udp \

             -s $IPADDR --sport $UNPRIVPORTS \

             -d $NAMESERVER --dport 53 \

             -m state --state NEW -j ACCEPT

probably one or more of your variables is not defined correctly.



You can use the command:

# sh -x /etc/rc.d/rc.firewalls &> trace

to run the script and find what the error was in interpreting it.

This command will produce a file called 'trace' which will show each command
the way it was interpreted and (because of the '&') will also show the error
messages produced as a result.



That should help you to figure out exactly where the error is coming from.



Good luck Dave! You're starting a fun ride!



----------------

Larry Flathmann

Systems & Data Integrators

www.sdintegrators.com

  -----Original Message-----
  From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Sundaram
  Sent: Wednesday, October 09, 2002 10:55 PM
  To: David F. Strauch; netfilter@lists.netfilter.org
  Subject: Re: Bad argument `53'


  I have this rules set in my  firewall, it is working for me.

  $IPT -A OUTPUT -o $EXT -p tcp --sport $UNPRI --dport 53 -j ACCEPT

  $IPT -t nat -A PREROUTING  -i $EXT -d $EXT_IP1  -p tcp --dport 25 -j
DNAT --to $INT_IP1
  $IPT -A FORWARD -p tcp  --dport 25 -d $INT_IP1 -j ACCEPT

  I am also using REdhat 7.3 Kernel 2.4.18-3 and iptables 1.2.7
    ----- Original Message -----
    From: David F. Strauch
    To: netfilter@lists.netfilter.org
    Sent: Wednesday, October 09, 2002 10:17 PM
    Subject: Bad argument `53'


    Hello Everyone



    By reading New Riders “Linux Firewalls” by Robert L. Ziegler I’m just
starting to study iptables.  I have a stand-alone firewall offline and off
the local network running RHL 7.3 with Kernel 2.4.18-3 and iptables 1.2.5.



    I’ve just started writing the script to allow DNS Loopkups as a client
with the following:



    if [ "$CONNECTION_TRACKING" = "1" ]; then

        iptables -A OUTPUT -o $INTERNET -p udp \

                 -s $IPADDR --sport $UNPRIVPORTS \

                 -d $NAMESERVER --dport 53 \

                 -m state --state NEW -j ACCEPT

    fi



    iptables -A OUTPUT -o $INTERNET -p udp \

             -s $IPADDR --sport $UNPRIVPORTS \

             -d $NAMESERVER --dport 53 -j ACCEPT



    iptables -A INPUT  -i $INTERNET -p udp \

             -s $NAMESERVER --sport 53 \

             -d $IPADDR --dport $UNPRIVPORTS -j ACCEPT



    When I execute the script with sh /etc/rc.d/rc.firewalls I receive Bad
argument `53' for every instance of either  --dport 53 or --sport 53.  I’ve
also tried --destination-port and --source-port with out any success.



    Can anyone shed some light on my problem?

    Dave

[-- Attachment #2: Type: text/html, Size: 14795 bytes --]

Re: Bad argument `53'

[Antony Stone]

On Thursday 10 October 2002 3:17 am, David F. Strauch wrote:

> I?ve just started writing the script to allow DNS Loopkups as a client with
> the following:
>
> iptables -A OUTPUT -o $INTERNET -p udp \
>          -s $IPADDR --sport $UNPRIVPORTS \
>          -d $NAMESERVER --dport 53 -j ACCEPT

Why are you specifying Source Address and Port on an OUTPUT rule ?

> iptables -A INPUT  -i $INTERNET -p udp \
>          -s $NAMESERVER --sport 53 \
>          -d $IPADDR --dport $UNPRIVPORTS -j ACCEPT

Is it really necessary to specify Destination Address and Port on an INPUT 
rule ?   How many addresses do you have on your interface, and why would you 
only want some of them to receive DNS replies ?

> When I execute the script with sh /etc/rc.d/rc.firewalls I receive Bad
> argument `53' for every instance of either  --dport 53 or --sport 53.  I?ve
> also tried --destination-port and --source-port with out any success.

Check what the earlier variables in the command contain.   I think you'll 
probably find one (or more) of them is empty.

Antony.

-- 

Abandon hope, all ye who enter here.
You'll feel much better about things once you do.