Chain INPUT OUTPUT start with ACCEPT all 0.0.0.0/0 0.0.0.0/0 rule, how to read ?

[CVIS]

On ESX 3.5, used iptables to verify the actual configuration.

Firewall starts for chain INPUT OUTPUT with any-rule, ACCEPT all -- 0.0.0.0/0 0.0.0.0/0\

Firewall is enabled for incoming and outgoing. Does this mean all traphic is passed ?

esxcfg-firewall provides additionally in and out status. What do these columns mean ?

I'm looking for documentation on esxcfg-firewall explaining in / out columns.

iptables -nL

Chain INPUT (policy DROP)

target prot opt source destination

ACCEPT all -- 0.0.0.0/0 0.0.0.0/0

valid-tcp-flags tcp -- 0.0.0.0/0 0.0.0.0/0

valid-source-address ! udp -- 0.0.0.0/0 0.0.0.0/0

valid-source-address-udp udp -- 0.0.0.0/0 0.0.0.0/0

valid-source-address tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x16/0x02

icmp-in icmp -- 0.0.0.0/0 0.0.0.0/0

ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED

esxcfg-firewall -q

Chain INPUT (policy DROP 7 packets, 911 bytes)

pkts bytes target prot opt in out source destination

185 52786 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0

151 22108 valid-tcp-flags tcp -- * * 0.0.0.0/0 0.0.0.0/0

151 22108 valid-source-address ! udp -- * * 0.0.0.0/0 0.0.0.0/0

81 28560 valid-source-address-udp udp -- * * 0.0.0.0/0 0.0.0.0/0

3 168 valid-source-address tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x16/0x02

[Texiwill]

Hello,

The In and Out column specify on which interface the packets are allowed in and out. An '*' implies all interfaces. 'lo' implies just the loopback device. If you wish to augment your security by interface you will need to set that using iptables. Personally I would not do this as an update would wipe out your changes, but it is possible.

Augmenting the iptables firewall is discussed within my book: VMware vSphere and Virtual Infrastructure Security

To make things 'stick' past a reboot you will need to modify /etc/rc.d/rc.local with the necessary changes. But then check when you update ESX that these changes have stuck through the update process. You may want to keep a second copy of rc.local that you know has only your mods (/root/rc.local.iptables) and call it from within /etc/rc.d/rc.local. That way you have a copy somewhere incase an update reverts it.

Best regards,

Edward L. Haletky

Communities Moderator, VMware vExpert,

Author: VMware vSphere and Virtual Infrastructure Security,VMware ESX and ESXi in the Enterprise 2nd Edition (do out mid January)

Podcast: The Virtualization Security Podcast Resources: The Virtualization Bookshelf

[CVIS]

Edward,

I was hoping to get an "official" VMware reference/whitepaper.

Can you point me out ?

Thanks.

[Texiwill]

Hello,

No such whitepaper exists. They do not want you to modify the iptables firewall directly. It is possible but care must be taken as well as detailed knowledge of iptables is required. Also, since ESXi has no such firewall for the management appliance you are stuck using an external firewall which has its own rules, etc.

Best regards,

Edward L. Haletky

Communities Moderator, VMware vExpert,

Author: VMware vSphere and Virtual Infrastructure Security,VMware ESX and ESXi in the Enterprise 2nd Edition (do out mid January)

Podcast: The Virtualization Security Podcast Resources: The Virtualization Bookshelf