Shorewall users - May 2003 - Sequence of Loading bit me

While installing Shorewall on my laptop which also runs vmware I found
that the default sequence that SuSE 8.2 decides to load shorewall
can cause some problems.

When running samba on the firewall (to support vmware in this case)
nmbd bails out if it can''t find any interfaces, and it won''t
find interfaces
untill both vmware and shorewall are running.

   VMware has to be loaded before samba so that the vmnet(x)
   interface is found.

   Shorewall also might have a problem if one of its interfaces is
   non-existant (especially with the "detect" parameter), so  I had
   to load vmware before it as well.

The sequence I ended up with was
  network
  vmware
  shorewall  
  nmdb
  smbd

This might not be so picky if I let the vmnet
interface be routed while stopped (routestopped) but
I didn''t want to do this, and if shorewall is not running
nmbd bails out complaining of no interfaces.

TOM... Somewhere on your page I thought it said you
used vmware.  Did you find this to be something you
have to tweak?  Is there a FAQ on it?

This discovery also pointed out why nmb was failing on my
main server at the office, but that gets re-booted so seldom
that I failed to dig deep enough.

-- 
John Andersen - NORCOM
http://www.norcomsoftware.com/

On Mon, 12 May 2003 20:34:30 -0800, John Andersen
<jsa@norcomix.dyndns.org>
wrote:
>
> TOM... Somewhere on your page I thought it said you
> used vmware.  Did you find this to be something you
> have to tweak?
I run Vmware on my deskstop -- that system only runs Shorewall for brief 
periods when I''m smoke-testing new/modified code.
> Is there a FAQ on it?
No. It can hardly be considered a FAQ since this is the first time that it 
has come up.

I believe that end users need to be prepared to change the order in which 
services are started, especially when some of those services (like 
Shorewall and Vmware) aren''t part of their distribution. Independent 
vendors like myself make a guess as to what start and stop priority to give 
our products but we can''t anticipate what the distros and other
independent
vendors are going to do and/or what the possible interactions might be.

-Tom
-- 
Tom Eastep    \ Shorewall - iptables made easy
Shoreline,     \ http://www.shorewall.net
Washington USA  \ teastep@shorewall.net