Open Ports on ESXi 4

[VCXD]

Under what circumstances one has to open ports on an ESXi 4 server. The newwork admin insists that the port is blocked at the ESXi 4 host level. He is trying to get out via a VM that is unable to connect to a service on a remote server. So, he keep insisting that we open port/s on the ESXi 4 server. How would I open a port 10001 on ESXi 4 server or make sure it's not blocked at the ESXi 4 server. 

Regards,

[JonathanG]

Unless you have 3rd party firewall, Operating system firewall (iptables, windowsfirewall) or vShield in place to do firewalling,  ESX host does not block ports on a VM.

Try the following:

Telnet from VM to Remote server, over the requested port, and see if you get a connection.

Example from VM:

# telnet remoteserver 80

will test if I can connect from VM to a webserver (port 80) running on the remote server.

Ping from VM to Remote server, to see if basic network connectivity exists. Or do a tracert.

Execute netstat -ad on the VM & remote server and see what connections are open and listening.

[mcowger · Accepted solution]

ESXi has no *ability* to block a port to a VM - its a layer 2 switch (unless you are using Nexus 1KV) - there is nothing to check.

[Texiwill]

Hello,

Are there any firewalls between the VM and vSwitch Portgroup, perhaps, see below:

       VM <--> vNIC <-> VMSafe-Net <--> Portgroup <--> vSwitch

The VM could have a firewall in it such as Windows Firewall, Linux IPtables, or use of TCPwrappers. The vNIC cannot have a firewall in it. If you have something like one of the VMsafe-Net tools (vShield App, vShield Zones, Trend Micro Deep Security, IBM VSS, Juniper vGW (aka Altor), Reflex Systems vTrust, Checkpoint Virtual Edition, and maybe one or two others) then yes the VMsafe-Net provides a firewall. There is no firewall in the Portgroup or the vSwitch.

However if the vSwitch is a dVSwitch you can have Private VLANs that could deny access as well per the following:

VM <--> vNIC <-> VMSafe-Net <--> Portgroup <--> dVSwitch

There is NO firewall within the Management appliance of ESXi either. That must be protected as well.

YOu can also have inline firewalls per the following:

VM <--> vNIC <-> VMSafe-Net <--> Portgroup <--> vSwitch <--> Portgroup <--> vFW <--> Portgroup <--> vSwitch

So the question becomes what do you have in place? And in addition, what routing is in place as if your routing is not correct or the vNetwork not connected to the outside properly there is a chance traffic will also not work outside the ESXi host.

Lots of places to put firewalls/security however there are other issues at hand as well such as routing, connectivity, etc.

Best regards,

Edward L. Haletky

Communities Moderator, VMware vExpert,

Author: VMware vSphere and Virtual Infrastructure Security,VMware ESX and ESXi in the Enterprise 2nd Edition

Podcast: The Virtualization Security Podcast Resources: The Virtualization Bookshelf

[VCXD]

Thank you all very much!