Problems accessing ESX web client from internet

[Mirekmal]

Hello there!

I have a very strange problem that cannot resolve on my own; I have some issues accessing my ESX host (6.0U2 free hypervisor) from Internet. Configuration/problems are as follows:

• ESX host has static IP and embedded web client is working perfectly fine including VM consoles when connecting from inside the LAN.
• I have reverse proxy (on Synology NAS) configured to access ESX web client from internet and it is working almost fine (I can access and work with web client). There is problem with accessing VMs' remote consoles – any attempt to open one results in Failed to connect (when opening console in popup) or in just blue background with VMware logo (if opening in new window or tab). I guess this might be because of consoles using different port to display content (902? Instead of 443) and reverse proxy only allows to use one port. This is something I did not found a way to configure on reverse proxy.
• So I setup also port redirection on my router (ext 44320 to int 443 and 8020 ext to int 80 pointing to ESX host) to be able to access web client more directly. And here it fails at all, not making any connection. It was working in the past, but at some point of time it stopped and I cannot figure out what happened. I tried to change the ports and/or internal ESX IP, but no change. Seems like ESX host does not communicate via default gateway (in case of reverse proxy traffic goes via other internal IP).
• No problems for VMs, these can communicate freely with internet and I can access all configured services (mail, web, some monitoring system) from internet.

Any idea of what might be wrong? To me it looks like perhaps ESX host firewall misconfiguration, prohibiting communication with/via default gateway, but I was not able to figure out any blocking rule…

[ChrisFD2]

Which router/firewall do you have?

Some are very funny when it comes to port forwarding https traffic, they'll allow you to configure it but it won't work. I believe Ubiquiti does this and some others I have encountered.

[Mirekmal]

It is Draytek Vigor 2925... so far very solid experience, absolutely no problems whatsoever... stable and predictable.

[ChrisFD2]

As a network engineer, I am not a huge fan of Draytek! They seem to make up their own networking terminology.

Are you seeing hit counters on the incoming NAT rule?

[Mirekmal]

No, I do not see anywhere hit counters... perhaps are available via SNMP, but I do not have a tool to check this.

What I see however is NAT session table, that at the moment when I try to make a connections shows something like that:

-------------------------------------------------------------------------------

   Private IP :Port #Pseudo Port        Peer IP :Port  Interface

-------------------------------------------------------------------------------

192.168.xx.20    80      8020   15.xxx.xxx.86 61484    WAN1

192.168.xx.20  443    44320   15.xxx.xxx.86 62019    WAN1

So seems connection is made and redirection is done properly, to right IP and port... No response received though.