From mboxrd@z Thu Jan 1 00:00:00 1970 From: "David F. Strauch" Subject: Bad argument `53' Date: Wed, 9 Oct 2002 21:17:23 -0500 Sender: netfilter-admin@lists.netfilter.org Message-ID: <002a01c27003$2c9d14e0$0201a8c0@com> Reply-To: "David F. Strauch" Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0027_01C26FD9.42B2DDC0" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0027_01C26FD9.42B2DDC0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Hello Everyone By reading New Riders =93Linux Firewalls=94 by Robert L. Ziegler I=92m = just starting to study iptables. I have a stand-alone firewall offline = and off the local network running RHL 7.3 with Kernel 2.4.18-3 and = iptables 1.2.5. =20 I=92ve just started writing the script to allow DNS Loopkups as a client = with the following: =20 if [ "$CONNECTION_TRACKING" =3D "1" ]; then iptables -A OUTPUT -o $INTERNET -p udp \ -s $IPADDR --sport $UNPRIVPORTS \ -d $NAMESERVER --dport 53 \ -m state --state NEW -j ACCEPT fi =20 iptables -A OUTPUT -o $INTERNET -p udp \ -s $IPADDR --sport $UNPRIVPORTS \ -d $NAMESERVER --dport 53 -j ACCEPT =20 iptables -A INPUT -i $INTERNET -p udp \ -s $NAMESERVER --sport 53 \ -d $IPADDR --dport $UNPRIVPORTS -j ACCEPT =20 When I execute the script with sh /etc/rc.d/rc.firewalls I receive Bad = argument `53' for every instance of either --dport 53 or --sport 53. = I=92ve also tried --destination-port and --source-port with out any = success. =20 Can anyone shed some light on my problem? Dave ------=_NextPart_000_0027_01C26FD9.42B2DDC0 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Hello=20 Everyone

By=20 reading New Riders =93Linux Firewalls=94 by Robert L. Ziegler I=92m just = starting to=20 study iptables. I have a=20 stand-alone firewall offline and off the local network running RHL 7.3 = with=20 Kernel 2.4.18-3 and iptables 1.2.5.

I=92ve just=20 started writing the script to allow DNS Loopkups as a client with the=20 following:

if [=20 "$CONNECTION_TRACKING" =3D "1" ]; then

iptables -A OUTPUT = -o=20 $INTERNET -p udp \

&n= bsp;=20 -s $IPADDR --sport $UNPRIVPORTS \

&n= bsp;=20 -d $NAMESERVER --dport 53 \

&n= bsp;=20 -m state --state NEW -j ACCEPT

iptables -A=20 OUTPUT -o $INTERNET -p udp \

=20 -s $IPADDR --sport $UNPRIVPORTS \

=20 -d $NAMESERVER --dport 53 -j ACCEPT

iptables -A=20 INPUT -i $INTERNET -p udp = \

=20 -s $NAMESERVER --sport 53 \

=20 -d $IPADDR --dport $UNPRIVPORTS -j = ACCEPT

When I=20 execute the script with sh /etc/rc.d/rc.firewalls I receive Bad argument = `53'=20 for every instance of either =20 --dport 53 or --sport 53. = I=92ve also tried --destination-port and --source-port with out = any=20 success.

Can anyone shed some light on my = problem?

Dave

------=_NextPart_000_0027_01C26FD9.42B2DDC0-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Sundaram" Subject: Re: Bad argument `53' Date: Wed, 9 Oct 2002 23:55:17 -0400 Sender: netfilter-admin@lists.netfilter.org Message-ID: <002501c27010$da433360$4101a8c0@ramasamy> References: <002a01c27003$2c9d14e0$0201a8c0@com> Reply-To: "Sundaram" Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0022_01C26FEF.513ACC70" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: "David F. Strauch" , netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0022_01C26FEF.513ACC70 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable I have this rules set in my firewall, it is working for me. $IPT -A OUTPUT -o $EXT -p tcp --sport $UNPRI --dport 53 -j ACCEPT $IPT -t nat -A PREROUTING -i $EXT -d $EXT_IP1 -p tcp --dport 25 -j = DNAT --to $INT_IP1 $IPT -A FORWARD -p tcp --dport 25 -d $INT_IP1 -j ACCEPT I am also using REdhat 7.3 Kernel 2.4.18-3 and iptables 1.2.7 ----- Original Message -----=20 From: David F. Strauch=20 To: netfilter@lists.netfilter.org=20 Sent: Wednesday, October 09, 2002 10:17 PM Subject: Bad argument `53'=20 Hello Everyone By reading New Riders =93Linux Firewalls=94 by Robert L. Ziegler I=92m = just starting to study iptables. I have a stand-alone firewall offline = and off the local network running RHL 7.3 with Kernel 2.4.18-3 and = iptables 1.2.5. =20 I=92ve just started writing the script to allow DNS Loopkups as a = client with the following: =20 if [ "$CONNECTION_TRACKING" =3D "1" ]; then iptables -A OUTPUT -o $INTERNET -p udp \ -s $IPADDR --sport $UNPRIVPORTS \ -d $NAMESERVER --dport 53 \ -m state --state NEW -j ACCEPT fi =20 iptables -A OUTPUT -o $INTERNET -p udp \ -s $IPADDR --sport $UNPRIVPORTS \ -d $NAMESERVER --dport 53 -j ACCEPT =20 iptables -A INPUT -i $INTERNET -p udp \ -s $NAMESERVER --sport 53 \ -d $IPADDR --dport $UNPRIVPORTS -j ACCEPT =20 When I execute the script with sh /etc/rc.d/rc.firewalls I receive Bad = argument `53' for every instance of either --dport 53 or --sport 53. = I=92ve also tried --destination-port and --source-port with out any = success. =20 Can anyone shed some light on my problem? Dave ------=_NextPart_000_0022_01C26FEF.513ACC70 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

I have this rules set in my = firewall, it is=20 working for me.

$IPT -A OUTPUT -o $EXT -p tcp --sport = $UNPRI=20 --dport 53 -j ACCEPT

$IPT -t nat -A PREROUTING -i $EXT = -d=20 $EXT_IP1 -p tcp --dport 25 -j DNAT --to $INT_IP1
$IPT -A = FORWARD -p=20 tcp --dport 25 -d $INT_IP1 -j ACCEPT

I am also using REdhat 7.3 Kernel = 2.4.18-3 and=20 iptables 1.2.7

----- Original Message -----
From:=20 David F.=20 Strauch
To: netfilter@lists.netfilter.o= rg=20

Sent: Wednesday, October 09, = 2002 10:17=20 PM

Subject: Bad argument `53' =

Hello=20 Everyone

By reading New Riders =93Linux Firewalls=94 by Robert L. = Ziegler I=92m just=20 starting to study iptables. = I=20 have a stand-alone firewall offline and off the local network running = RHL 7.3=20 with Kernel 2.4.18-3 and iptables 1.2.5.

I=92ve=20 just started writing the script to allow DNS Loopkups as a client with = the=20 following:

if [=20 "$CONNECTION_TRACKING" =3D "1" ]; then

    iptables -A = OUTPUT -o=20 $INTERNET -p udp \

           &n= bsp;=20 -s $IPADDR --sport $UNPRIVPORTS \

           &n= bsp;=20 -d $NAMESERVER --dport 53 \

           &n= bsp;=20 -m state --state NEW -j ACCEPT

fi

iptables=20 -A OUTPUT -o $INTERNET -p udp \

        =20 -s $IPADDR --sport $UNPRIVPORTS \

        =20 -d $NAMESERVER --dport 53 -j = ACCEPT

iptables=20 -A INPUT -i $INTERNET = -p udp=20 \

        =20 -s $NAMESERVER --sport 53 \

        =20 -d $IPADDR --dport $UNPRIVPORTS -j = ACCEPT

When I=20 execute the script with sh /etc/rc.d/rc.firewalls I receive Bad = argument `53'=20 for every instance of either =20 --dport 53 or --sport 53. =20 I=92ve also tried --destination-port and --source-port with out = any=20 success.

Can anyone shed some light on my=20 problem?

Dave

------=_NextPart_000_0022_01C26FEF.513ACC70-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Larry Flathmann" Subject: RE: Bad argument `53' Date: Wed, 9 Oct 2002 23:17:16 -0500 Sender: netfilter-admin@lists.netfilter.org Message-ID: References: <002501c27010$da433360$4101a8c0@ramasamy> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0041_01C26FEA.01DC9960" Return-path: In-Reply-To: <002501c27010$da433360$4101a8c0@ramasamy> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Sundaram , "David F. Strauch" , netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0041_01C26FEA.01DC9960 Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: quoted-printable When you get an error message about a bad argument, it's usually because something earlier in the line was missing. So, for example, in the command: iptables -A OUTPUT -o $INTERNET -p udp \ -s $IPADDR --sport $UNPRIVPORTS \ -d $NAMESERVER --dport 53 \ -m state --state NEW -j ACCEPT probably one or more of your variables is not defined correctly. You can use the command: # sh -x /etc/rc.d/rc.firewalls &> trace to run the script and find what the error was in interpreting it. This command will produce a file called 'trace' which will show each command the way it was interpreted and (because of the '&') will also show the error messages produced as a result. That should help you to figure out exactly where the error is coming from. Good luck Dave! You're starting a fun ride! ---------------- Larry Flathmann Systems & Data Integrators www.sdintegrators.com -----Original Message----- From: netfilter-admin@lists.netfilter.org [mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Sundaram Sent: Wednesday, October 09, 2002 10:55 PM To: David F. Strauch; netfilter@lists.netfilter.org Subject: Re: Bad argument `53' I have this rules set in my firewall, it is working for me. $IPT -A OUTPUT -o $EXT -p tcp --sport $UNPRI --dport 53 -j ACCEPT $IPT -t nat -A PREROUTING -i $EXT -d $EXT_IP1 -p tcp --dport 25 -j DNAT --to $INT_IP1 $IPT -A FORWARD -p tcp --dport 25 -d $INT_IP1 -j ACCEPT I am also using REdhat 7.3 Kernel 2.4.18-3 and iptables 1.2.7 ----- Original Message ----- From: David F. Strauch To: netfilter@lists.netfilter.org Sent: Wednesday, October 09, 2002 10:17 PM Subject: Bad argument `53' Hello Everyone By reading New Riders =93Linux Firewalls=94 by Robert L. Ziegler I=92m = just starting to study iptables. I have a stand-alone firewall offline and off the local network running RHL 7.3 with Kernel 2.4.18-3 and iptables 1.2.5. I=92ve just started writing the script to allow DNS Loopkups as a client with the following: if [ "$CONNECTION_TRACKING" =3D "1" ]; then iptables -A OUTPUT -o $INTERNET -p udp \ -s $IPADDR --sport $UNPRIVPORTS \ -d $NAMESERVER --dport 53 \ -m state --state NEW -j ACCEPT fi iptables -A OUTPUT -o $INTERNET -p udp \ -s $IPADDR --sport $UNPRIVPORTS \ -d $NAMESERVER --dport 53 -j ACCEPT iptables -A INPUT -i $INTERNET -p udp \ -s $NAMESERVER --sport 53 \ -d $IPADDR --dport $UNPRIVPORTS -j ACCEPT When I execute the script with sh /etc/rc.d/rc.firewalls I receive Bad argument `53' for every instance of either --dport 53 or --sport 53. I=92= ve also tried --destination-port and --source-port with out any success. Can anyone shed some light on my problem? Dave ------=_NextPart_000_0041_01C26FEA.01DC9960 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

When=20 you get an error message about a bad argument, it's usually because = something=20 earlier in the line was missing. So, for example, in the=20 command:

iptables -A OUTPUT = -o=20 $INTERNET -p udp \

&n= bsp;=20 -s $IPADDR --sport $UNPRIVPORTS \

&n= bsp;=20 -d $NAMESERVER --dport 53 \

&n= bsp;=20 -m state --state NEW -j ACCEPT

probably one or more of = your variables=20 is not defined correctly.

You can use the=20 command:

# sh -x = /etc/rc.d/rc.firewalls=20 &> trace

to run the script and find = what the=20 error was in interpreting it.

This command will produce = a file=20 called 'trace' which will show each command the way it was = interpreted and=20 (because of the '&') will also show the error messages produced as a = result.

That should help you to = figure out=20 exactly where the error is coming from.

Good luck Dave! You're = starting a fun=20 ride!

----------------

Larry=20 Flathmann

Systems & Data=20 Integrators

www.sdintegrators.com=20

-----Original Message-----
From:=20 netfilter-admin@lists.netfilter.org=20 [mailto:netfilter-admin@lists.netfilter.org]On Behalf Of=20 Sundaram
Sent: Wednesday, October 09, 2002 10:55=20 PM
To: David F. Strauch;=20 netfilter@lists.netfilter.org
Subject: Re: Bad argument `53' =

I have this rules set in my = firewall, it is=20 working for me.

$IPT -A OUTPUT -o $EXT -p tcp --sport = $UNPRI=20 --dport 53 -j ACCEPT

$IPT -t nat -A PREROUTING -i = $EXT -d=20 $EXT_IP1 -p tcp --dport 25 -j DNAT --to $INT_IP1
$IPT -A = FORWARD -p=20 tcp --dport 25 -d $INT_IP1 -j ACCEPT

I am also using REdhat 7.3 Kernel = 2.4.18-3 and=20 iptables 1.2.7

----- Original Message -----
From:=20 David=20 F. Strauch
To: netfilter@lists.netfilter.o= rg=20

Sent: Wednesday, October 09, = 2002 10:17=20 PM

Subject: Bad argument `53' =

Hello=20 Everyone

By reading New Riders =93Linux Firewalls=94 by Robert L. = Ziegler I=92m just=20 starting to study iptables. = I=20 have a stand-alone firewall offline and off the local network = running RHL=20 7.3 with Kernel 2.4.18-3 and iptables 1.2.5.

I=92ve=20 just started writing the script to allow DNS Loopkups as a client = with the=20 following:

if [=20 "$CONNECTION_TRACKING" =3D "1" ]; then

    iptables -A = OUTPUT -o=20 $INTERNET -p udp \

           &n= bsp;=20 -s $IPADDR --sport $UNPRIVPORTS = \

           &n= bsp;=20 -d $NAMESERVER --dport 53 \

           &n= bsp;=20 -m state --state NEW -j ACCEPT

fi

iptables -A OUTPUT -o $INTERNET -p udp=20 \

        =20 -s $IPADDR --sport $UNPRIVPORTS = \

        =20 -d $NAMESERVER --dport 53 -j = ACCEPT

iptables -A INPUT -i=20 $INTERNET -p udp \

        =20 -s $NAMESERVER --sport 53 \

        =20 -d $IPADDR --dport $UNPRIVPORTS -j=20 ACCEPT

When=20 I execute the script with sh /etc/rc.d/rc.firewalls I receive Bad = argument=20 `53' for every instance of either =20 --dport 53 or --sport 53. =20 I=92ve also tried --destination-port and --source-port with = out any=20 success.

Can anyone shed some light on my=20 problem?

Dave

= ------=_NextPart_000_0041_01C26FEA.01DC9960-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: Bad argument `53' Date: Thu, 10 Oct 2002 07:34:28 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20021010063434.WSKG7631.mta03-svc.ntlworld.com@there> References: <002a01c27003$2c9d14e0$0201a8c0@com> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <002a01c27003$2c9d14e0$0201a8c0@com> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Thursday 10 October 2002 3:17 am, David F. Strauch wrote: > I?ve just started writing the script to allow DNS Loopkups as a client with > the following: > > iptables -A OUTPUT -o $INTERNET -p udp \ > -s $IPADDR --sport $UNPRIVPORTS \ > -d $NAMESERVER --dport 53 -j ACCEPT Why are you specifying Source Address and Port on an OUTPUT rule ? > iptables -A INPUT -i $INTERNET -p udp \ > -s $NAMESERVER --sport 53 \ > -d $IPADDR --dport $UNPRIVPORTS -j ACCEPT Is it really necessary to specify Destination Address and Port on an INPUT rule ? How many addresses do you have on your interface, and why would you only want some of them to receive DNS replies ? > When I execute the script with sh /etc/rc.d/rc.firewalls I receive Bad > argument `53' for every instance of either --dport 53 or --sport 53. I?ve > also tried --destination-port and --source-port with out any success. Check what the earlier variables in the command contain. I think you'll probably find one (or more) of them is empty. Antony. -- Abandon hope, all ye who enter here. You'll feel much better about things once you do.