Can I Manage a ESXi host that is behind a firewall?

[bdinerman]

Hello,

I am somewhat new to the VMWare world and am still learing some of the basics. I have an ESXi installation (latest version as of this post) that is sitting in a data center behind a firewall. I would like to be able to manage the host over the Internet using the VMWare Client when I am at my office. Is this possible? I assume that I would need to open some inbound ports on the data center firewall, but I cannot seem to find much information on this.

Can anyone assist?

Thank you,

bdinerman

[ablej]

Yes you will need to open the following ports 80, 443, and 902. Here is the documentation on page 117 of this guide http://www.vmware.com/pdf/vi3_35/esx_3i_i/r35u2/vi3_35_25_u2_3i_i_setup.pdf

David Strebel

www.holy-vm.com

If you find this information useful, please award points for "correct" or "helpful"

[lmonaco]

Yes - It can be done.

Are you using Virtual Center, or just connecting directly to the host with the VIC?

[lmonaco]

Yea, what David said...

[bdinerman]

Sounds reasonable enough. Unfortunately, I already have my firewall configured to forward HTTP and HTTPS packets to a Web server running on the virtual machine that the host supports. So unless it's possible to tweak the Infrastructure Client to listen on alternate ports, I may be stuck. I could try asking my data center for an additional, public IP address to use for this purpose, but I don't think they'll take to kindly to the request unless $$$ are involved.

Thank you,

Brad

[ablej]

I think to just manage ESXi through the VI client you will only need 443 and 902 open. Port 80 is used for the VI web interface which you might not use.

David Strebel

www.holy-vm.com

If you find this information useful, please award points for "correct" or "helpful"

[Dave_Mishchenko]

While it is possible to manage your host directly, it is not the best idea to do so. Given that you only have the single IP, why not drop in a VPN device and then make your initial connection to that and then to the ESXi host via the VPN connection.

[dennes]

Or just RDP into one of your servers and put the Infrastructure Client on that server. It's by far the easiest way.

If your VM's are running Windows that is..

Dennes

[Neil2526]

I am surprised that no one has mentioned locking down the forwarded ports by source IP. I agree it is risky to allow ANY IP access to 443 and 902 on an ESXi box, but if you manage the remote ESXi host from behind some static IPs, just open 443/902 for that static IP address or range. No one else will be able to get in, just you from that static IP.

[TonySth]

Does any of these VMWare Gurus have a blog or Article on step by step of how to setup a ESXi VMs for remote access?

All these short answer are not helpful to novice like us

[AndreTheGiant]

If you know Linux, build a Linux VM and use OpenVPN (or similar).

If you know Windows, use the VPN software included in RRAS.

Or look for an existing appliance that handle VPN connections.

Andre

[MauroBonder]

fyi all ports http://kb.vmware.com/kb/1012382

[mckarto]

I do manage ESXi 4.1 Hosts through a firewall (Astaro with SNAT/DNAT and the ports openend). I can connect the hosts and work with vCenter fine - until:

we got some issues like cloning a virtual machine. Even if I clone it on the same server, it always come back with the error: "cannot clone vm, cannot connect to host".

I disconnected, reconnected the host, all fine.

I found out, that in the /etc/opt/vmware/vpxa/vpxa.cfg the external IP of the host is listed (e.g. 111.222.222.222)

<vpxa>
<hostIp>111.222.222.222</hostIp>
...
<serverIp>222.111.111.111</serverIp>
</vpxa>

I changed it to the internal IP 192.168.2.111, restarted the services but the error stays.

Seems like it that some operations make a lookup of the fqdn hostname and than get the wrong IP Adress.

Did anybody solve this?

regards, Claudia

[mckarto]

I upgraded to Sphere 5 and learning for the VCP5 it says there, that NAT is not supported. So now I have the management network directly connected and only the vm networks behind the firewall. To answer my question: you cannot manage the esxi hosts behind a firewall but you can have the vms behind it.

cheers, Claudia

[Quila467]

Claudia wrote:

I upgraded to Sphere 5 and learning for the VCP5 it says there, that NAT is not supported. So now I have the management network directly connected and only the vm networks behind the firewall. To answer my question: you cannot manage the esxi hosts behind a firewall but you can have the vms behind it.

cheers, Claudia

You actually can manage an ESXi host that is behind a firewall.  I do it all the time.  I'm running vSphere Hypervisor on a PC at home and have it behind a Linux based firewall.  I use putty to SSH into the firewall and set up tunneling for ports 443, 902 and 903 to the local IP address of the ESXi host.  The vSphere client doesn't seem to like to connect to localhost, so when I'm connecting through a putty SSH tunnel I put an entry in the hosts file to point the name of my ESXi host to 127.0.0.1 and then I'm able to connect.

Connecting the management network directly to a publicly accessible network doesn't seem like a good idea to me.  SSH is open to all on my firewall, but there is only one user ID that is permitted to login via SSH, all other IDs are rejected even if the password is correct.

[mckarto]

Hi Quila

I was able to run the esxi hosts perfectly behind the firewall, but please try to clone a vm from one host to another one, having the vcenter in another subnet. That won't work.

Claudia