When you get an error message about a bad argument, it's usually because something earlier in the line was missing. So, for example, in the command:

iptables -A OUTPUT -o $INTERNET -p udp \

-s $IPADDR --sport $UNPRIVPORTS \

-d $NAMESERVER --dport 53 \

-m state --state NEW -j ACCEPT

probably one or more of your variables is not defined correctly.

You can use the command:

# sh -x /etc/rc.d/rc.firewalls &> trace

to run the script and find what the error was in interpreting it.

This command will produce a file called 'trace' which will show each command the way it was interpreted and (because of the '&') will also show the error messages produced as a result.

That should help you to figure out exactly where the error is coming from.

Good luck Dave! You're starting a fun ride!

----------------

Larry Flathmann

Systems & Data Integrators

www.sdintegrators.com

-----Original Message-----
From: netfilter-admin@lists.netfilter.org [mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Sundaram
Sent: Wednesday, October 09, 2002 10:55 PM
To: David F. Strauch; netfilter@lists.netfilter.org
Subject: Re: Bad argument `53'

I have this rules set in my firewall, it is working for me.

$IPT -A OUTPUT -o $EXT -p tcp --sport $UNPRI --dport 53 -j ACCEPT

$IPT -t nat -A PREROUTING -i $EXT -d $EXT_IP1 -p tcp --dport 25 -j DNAT --to $INT_IP1
$IPT -A FORWARD -p tcp --dport 25 -d $INT_IP1 -j ACCEPT

I am also using REdhat 7.3 Kernel 2.4.18-3 and iptables 1.2.7

----- Original Message -----

From: David F. Strauch

To: netfilter@lists.netfilter.org

Sent: Wednesday, October 09, 2002 10:17 PM

Subject: Bad argument `53'

Hello Everyone

By reading New Riders “Linux Firewalls” by Robert L. Ziegler I’m just starting to study iptables. I have a stand-alone firewall offline and off the local network running RHL 7.3 with Kernel 2.4.18-3 and iptables 1.2.5.

I’ve just started writing the script to allow DNS Loopkups as a client with the following:

if [ "$CONNECTION_TRACKING" = "1" ]; then

    iptables -A OUTPUT -o $INTERNET -p udp \

             -s $IPADDR --sport $UNPRIVPORTS \

             -d $NAMESERVER --dport 53 \

             -m state --state NEW -j ACCEPT

fi

iptables -A OUTPUT -o $INTERNET -p udp \

         -s $IPADDR --sport $UNPRIVPORTS \

         -d $NAMESERVER --dport 53 -j ACCEPT

iptables -A INPUT -i $INTERNET -p udp \

         -s $NAMESERVER --sport 53 \

         -d $IPADDR --dport $UNPRIVPORTS -j ACCEPT

When I execute the script with sh /etc/rc.d/rc.firewalls I receive Bad argument `53' for every instance of either --dport 53 or --sport 53. I’ve also tried --destination-port and --source-port with out any success.

Can anyone shed some light on my problem?

Dave