Thanks to all who responded.
Despite hearing about dependency-based boot functionality, I
had presumed that run-level information was sufficient for a
service to start.
Adding the dependency information as per Olaf's reply, the
firewall starts correctly on boot.
In the process I learned a little more about sysvinit
runscripts and their symlinks, also about event-based
networking scripts.
--
Joel Roth