Firewall Slows Bootup Bigtime
 

I have my wireless LAN secured using a VPN between each wireless system and the VPN gateway to my internal network. Here is the layout -->

<wirelesslan>----<VPNGATEWAY>----<Internal(wired) LAN>----<Internet>

The VPN gatewate is firewalled so that it only lets VPN packets through, and everything works fine with my setup but the Fedora Core 1 Linux box I have as a client takes forever to boot up, and gets service failure notice ( such as NTP time sync ) when it boots up. Before I firewalled off the wireless network, it took about 1 minute to boot up into graphical mode, now it takes about 20 minutes.

The problem is ( I think ) is that network services are starting before the VPN tunnel is created, caused the delay as they try to do things like synchronize time, query DNS, etc. In fact I had to move the command to mount SMB shares all the way up to the user login script, or else I wouldn't even get to the Graphical Logon screen!

Now, the current setup on the wireless client is start network services normally, and then start the VPN tunnel service ( IPSEC is the service name, Freeswan is the software I am using ) in rc.local , and then mount shares, etc. I used to have the service start at bootup using the Redhat service config tool, but it never worked at all that way.

So, what I see as a solution to the problem is order the service startup so that network-related services do not start until after the VPN tunnel has been created, or perhaps I can had all the network service start in rc.local? The dilemma with the VPN tunnel not being created before network services start would still be an issue, in that case.

Hopefully my conumdrum made sense, I think if I can set the order services start, then my problem will be solved. Any ideas on how to do that? Oh, of course I can loosen the firewall rules on the VPN Gateway, let the wireless client boot, and then retighten them, but that ruins security plus would be a pain to automate.

ok, assuming you are using a default runlevel as 5, you can edit the /etc/rc.d/rc5.d/ files and change the numbers to change startup order

btw, heres a basic layout of the file names in there

example: K##servicename

First character: K means kill, S means start
Numeric Characters: startup sequence, lower numbers go first
servicename: service name that is starting, ethernet interfaces are "network"

That did it!
 

It worked like a charm, I used the Redhat services config tool to set IPSEC to start on bootup, then renamed its shortcut file to have it start directly after network ( in my case network was 10, and I made IPSEC number 11 ). After rebooting to test it, I am happy to say it comes up super-fast with no errors with network services.

Thank you for your help,


~Fortezza

no problem, sorry i didnt think of doing it that way with the gui, i learned linux on a command line, and thats how i work with it a lot of times