X-M0n0wall

[VMTN_Admin]

http://www.vmware.com/vmtn/appliances/directory/150

all-in-one firewall package upgraded with VMXnet, heartbeat and MUI-control

[nkrick]

Why does your physical host have to run Win2k3? With VMware Server installed, you can put anything you want on your physical host and run Win2k3 in a VM.

[Phero1]

Good question but I have some answers prepared

Firstly, W2k3 is the heaviest of the lot which is why I want it to allocate memory as needed instead of me having to put a static limit to it.

Secondly, I need to test an application deployment solution on w2k3 and since the solution package is being evaluated for full implementation I don't need to create any false obstacles for it to overcome. (Such as running it virtually).

Thirdly, why would I virtualize the OS I need the most ?

X-mono can run on 64 mb of memory with very little or no HD footprint, so I change the host OS to suit its needs?

[nkrick]

I like to use VMware Server in an "ESX like" environment. I use a thin GUI-less Linux OS and only install VMware Server on it. Then I do everything else in VM's.

VMware Workstation and VMware Server are geared towards test and development environments. At my company, most application development is performed inside a VM hosted by Workstation, Server, or ESX, depending on the application. We also use VMware Workstation and Server extensively for testing applications. VM's create a great, clean environment for development and testing. If you are using your physical host for dev and test, and running VMware server on it, as well as probably other applications not related to what you are testing, then you don't have a clean environment and probably have other "false obstacles" to worry about.

[briearn]

Hi *,

this is a really good FW application.

I have set this up for several LAN segments and now I have the problem, that I need the VLAN functionality or another solution to get around the problem, that I don't have any physical port left.

My physical box has 4 NICs. Two are used for the BACKEND[/b] as bond0 (vmnet0), one for the DMZ[/b] eth3 (vmnet2) and one for the DATABASE-BACKEND[/b] eth0 (vmnet3)

One FW was set up between BE and DB-BE, one between DMZ and BE and now I want to set up the next LAN segment and have set up another FW between the WAN-segment and the DMZ. Fine so far, but I have no vmnet available for the WAN anymore. So I have to use VLAN1 for the WAN and VLAN120 for the DMZ on the same [i]vmnet2[/i][/b] interface.

This would make the routing possible. How do I set this up? I mean I can not ssh to the FW ;-( otherwise I could use usual UNIX commands....

Thanks a lot for your help

Arne

[nkrick]

What version of VMware are you running? setting up VLANs on Server is different from ESX, etc. Also, whether or not you can use a VLAN comes down to your network also. You need to be using a switch that supports VLANs.

If your switch supports VLANs, you need to create the VLANs you are going to use (on the switch), then make sure that the network port to your server (vmnet0 or vmnet3?) is setup as a "trunk port" (you can control which VLANs are on the trunk if you want to, depending on your switch). You will also have to make sure the proper ports on your switch are set for the proper VLANs that those ports should be on. You then need to create/modify your virtual switches to make sure they are tagged as the proper VLAN.

[briearn]

Hi nkrick,

thanks a lot for your hints. Well, I'm running VMware Server 1.01 on FC5 with a Cluster over 4 SUN X4100. All are connected to two 3560G-48+4 with about 780 VLANs on. The SUN boxes boot from ISCSI with HBAs.

Your hint to use the interface directly in the physical system itself was really good. My inital idea was to use the different traffic VLANs only in the virtual hosts. But OK, you are absolutely right to say that we have to use it from the beginning on from the physical boxes.

Anyhow, thanks a lot,

Arne

[nkrick]

If you are going to use a VMware only network (a network that is contained completely on the VMware Server box) you don't have to use physical VLANs. Instead you can create new virtual switches with no NICs (no external connection) and then add a virtual network card attached to your new virtual switch to the existing M0n0wall firewall. That will give you an additional "Opt" interface in M0n0wall and you can do all your routing/networking internal to VMware Server. Since you mentioned VLAN's, I assumed that you need to connect an external server/network to a VMware internal network (ie to use a M0n0wall firewall).

[Kirek]

I'm not sure if I use the X-M0n0wall, but it is some version of it. And I run it in VMware Infrastructure 3 environment. On a HP DL385 AMD Opteron (64bit dual core)

It ran fine in the beginning, but then I upgraded as it said that there was a newer version available. And now it freezes once a day, not responding to anything.

Anybody else seen this?

[mpaldam]

Thank you first of all for an excellent appliance! I have been using this for a while as firewall / router for my small software business without any problems! One small inconvenience is that heartbeat isn't working, but this is not a major issue to me. Stability and performance have been fine.

I am running it on VMWare Server 1.0.1 on Ubuntu 6.0.6.

Now to my question: Do you plan to upgrade this appliance to m0n0wall 1.23, which is now final?

[brugh]

there's even been a small patch and there's a version 1.231 out now. and yes i'll update x-mono real soon. i tried several other firewalls based on linux and bsd but none do what monowall does. so i'm going to update my own x-mono soon and will let you guys know when that happens.

[mpaldam]

Hello Brugh,

Thanks for responding - an updated version would be greatly appreciated! Thank you anyway for making x-mono available in the first place. I will be watching this thread closely...

[brugh]

and since i had nothing better to do on a saterday night i applianciced my own x-mono and made it available on my homepage.

it's a little different from the original one:

• i removed the memcntrl driver since i never saw it ballooning anyway and even if it does, it wins 16mb?
  
• i activated the 3rd nic by default. at my own system it's not connected to a physical nic but you can do that if you want to. i run a virtual spam/virus/IDS/proxy-server on that virtual network so that works for me
  
• i added a sample rule for port 80 to NAT to an internal server. you may want to change that IP or remove the rule if you dont run a web server
  

and don't forget to set your own settings on general setup tab, change the IP/DHCP settings on the WAN interface and change the bandwidth settings on traffic shaping wizard. so i think that's all. have fun!

[brugh]

oh and if you're upgrading from an earlier version of x-mono, don't forget to save your settings at the backup/restore page. after unpacking this new version, simply restore the config and you're good to go!

[mpaldam]

Thanks - I've upgraded and all is fine - still no heartbeat though - but that is of minor concern...

[brugh]

that's weird. i hear more people having this problem. i have 100% heartbeat with x-mono so it's kinda hard to reproduce this issue.

try to see if the guestdaemon is running. open this page: http://yourfirewallip/exec.php and type 'ps -xw' . there should be a vmware-guestd in the list.

and what host are you running it on? i built it on vmware server 1.0.3 running on ubuntu 6.06 and never have any issues of this kind.

[mpaldam]

Thanks for responding!

The vmware-guest deamon seems not to be running - output of the ps -xw is:

$ ps -xw

PID TT STAT TIME COMMAND

0 ?? DLs 0:00.00 (swapper)

1 ?? SLs 0:00.05 /sbin/init --

2 ?? DL 0:00.00 (cryptoret)

3 ?? DL 0:00.00 (taskqueue)

4 ?? DL 0:00.02 (pagedaemon)

5 ?? DL 0:00.09 (bufdaemon)

6 ?? DL 0:00.10 (vnlru)

7 ?? DL 0:00.24 (syncer)

86 ?? Ss 0:01.19 /sbin/ipmon -sD

91 ?? Ss 0:00.63 /usr/sbin/syslogd -ss

94 ?? Ss 0:00.08 /usr/local/sbin/mini_httpd -c *.php|*.cgi -u root -maxproc 16 -i /var/run/mini_httpd.pid

101 ?? Is 0:00.04 /usr/local/sbin/dhcpd -cf /var/etc/dhcpd.conf vxn2

136 ?? I 0:00.00 /bin/sh /etc/rc.initial console

43025 ?? S 0:00.00 sleep 1

43026 ?? SN 0:00.11 /usr/local/bin/php exec.php

43027 ?? Z 0:00.00 (mini_httpd)

43028 ?? S 0:00.00 /usr/local/sbin/mini_httpd -c *.php|*.cgi -u root -maxproc 16 -i /var/run/mini_httpd.pid

43029 ?? SN 0:00.00 sh -c ps -xw

43030 ?? RN 0:00.00 ps -xw

104 con- I 0:00.20 /usr/local/sbin/snmpd -c /var/etc/snmpd.conf -P /var/run/snmpd.pid

108 con- I 0:00.02 /usr/local/sbin/choparp vxn1 auto XX.XX.XX.XX/32 XX.XX.XX.XX/32

110 con- S 0:31.48 /bin/sh /usr/local/bin/runmsntp.sh /var/run/runmsntp.pid /var/run/msntp.pid 300 XX.XX.XX.XX XX.XX.XX

I am running VMWare Server 1.0.1

[brugh]

did you build your own config after doing a factory reset? if so you'll be missing the line that starts the guestdaemon and you could try this:

goto the backup/restore page, download the configuration.xml open it in an editor (wordpad, not notepad! or better yet: 'vi') and add tags. save it and restore the config. after a reboot it should be running..

[mpaldam]

I don't think I did - but I may have...

Anyway your advice worked, and now I have heartbeat and host initiated shutdown, I assume!

Thank you very much for your help - it is greatly appreciated!

[brugh]

i updated the vmware tools version in this one too since there's been people who had problems with the stability of the appliance with the guestdaemon of earlier versions. perhaps you removed the line for those reasons some time ago? anyway, glad it works. let me know if it keeps working correctly now.

[mmi]

Are there idiot-proof instructions anywhere? I can't even figure out how to uncompress the .bz2 file. Linux is like Dutch to me...all I know is how to count to 10 and say a couple of swear words.

Thanks

Mike