When you get an error message about a bad argument, it's usually because
something earlier in the line was missing. So, for example, in the command:
    iptables -A OUTPUT -o $INTERNET -p udp \

             -s $IPADDR --sport $UNPRIVPORTS \

             -d $NAMESERVER --dport 53 \

             -m state --state NEW -j ACCEPT

probably one or more of your variables is not defined correctly.



You can use the command:

# sh -x /etc/rc.d/rc.firewalls &> trace

to run the script and find what the error was in interpreting it.

This command will produce a file called 'trace' which will show each command
the way it was interpreted and (because of the '&') will also show the error
messages produced as a result.



That should help you to figure out exactly where the error is coming from.



Good luck Dave! You're starting a fun ride!



----------------

Larry Flathmann

Systems & Data Integrators

www.sdintegrators.com

  -----Original Message-----
  From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Sundaram
  Sent: Wednesday, October 09, 2002 10:55 PM
  To: David F. Strauch; netfilter@lists.netfilter.org
  Subject: Re: Bad argument `53'


  I have this rules set in my  firewall, it is working for me.

  $IPT -A OUTPUT -o $EXT -p tcp --sport $UNPRI --dport 53 -j ACCEPT

  $IPT -t nat -A PREROUTING  -i $EXT -d $EXT_IP1  -p tcp --dport 25 -j
DNAT --to $INT_IP1
  $IPT -A FORWARD -p tcp  --dport 25 -d $INT_IP1 -j ACCEPT

  I am also using REdhat 7.3 Kernel 2.4.18-3 and iptables 1.2.7
    ----- Original Message -----
    From: David F. Strauch
    To: netfilter@lists.netfilter.org
    Sent: Wednesday, October 09, 2002 10:17 PM
    Subject: Bad argument `53'


    Hello Everyone



    By reading New Riders “Linux Firewalls” by Robert L. Ziegler I’m just
starting to study iptables.  I have a stand-alone firewall offline and off
the local network running RHL 7.3 with Kernel 2.4.18-3 and iptables 1.2.5.



    I’ve just started writing the script to allow DNS Loopkups as a client
with the following:



    if [ "$CONNECTION_TRACKING" = "1" ]; then

        iptables -A OUTPUT -o $INTERNET -p udp \

                 -s $IPADDR --sport $UNPRIVPORTS \

                 -d $NAMESERVER --dport 53 \

                 -m state --state NEW -j ACCEPT

    fi



    iptables -A OUTPUT -o $INTERNET -p udp \

             -s $IPADDR --sport $UNPRIVPORTS \

             -d $NAMESERVER --dport 53 -j ACCEPT



    iptables -A INPUT  -i $INTERNET -p udp \

             -s $NAMESERVER --sport 53 \

             -d $IPADDR --dport $UNPRIVPORTS -j ACCEPT



    When I execute the script with sh /etc/rc.d/rc.firewalls I receive Bad
argument `53' for every instance of either  --dport 53 or --sport 53.  I’ve
also tried --destination-port and --source-port with out any success.



    Can anyone shed some light on my problem?

    Dave