Accessing VM on a private IP range from Hypervisor OS possible?

[dghosh]

Hello Once Again,

I'm using ESXi 3.5 U4 on top of HP Proliant ML 110 G5 (the physical box has a single NIC) . Kudos for such a nice product. This is my 2nd post in the vmware community.

I intend to setup a private lan on ESXi so that there will be:

• vSwitch 0 is connected to the public interface card

• vSwitch 1 is a host-only switch for local networking between the VMs (not accessible from outside)

• vSwitch 2 is connected to the interface card on the management network

My first VM is meant to become the firewall & a reverse proxy with two NICs (one public facing & other facing private LAN). Now I want to access this first VM from hypervisor using the dropbear dbclient. Is this possible?

This is important as I intend to change the public facing IP if and whenever required from the host hypervisor by first accessing the first VM on its private IP and then change the public facing IP my editing networking configuration on it.

Is this possible anyway?

Thanks in advance.

dg

[kjb007 · Accepted solution]

No. The ESX server does not have a hidden backdoor IP connection to the vm. For that, you will either have to make the network routable (service console -> public ip), not a good idea. Or, have a 3rd NIC on the 1st vm to allow for this communication to occur. You can also add a 2nd service console on the internal only network, and allow ESX to communicate that way, but the normal networking rules apply in this scenario as well.

-KjB

VMware vExpert

[dghosh]

Hehe i don't want any backdoor :).

Can you please elaborate on how to do this network setup from the VI Client? Actually I'm a newbie to virtualization and even more so when it comes to hypervisor?

cheers

dg

[kjb007]

If all you are trying to do is go into the 1st vm and modify it's

public IP, then you don't really need to do anything additional. You

can use the vi client and access the console from the ESX host to modify whatever networking

that you need. The console will work whether there is networking to any vm or not. Will that not work for what you intend, or am I missing something?

-KjB

VMware vExpert

[dghosh]

yea thats absolutely true that using VI Client i can access the vm directly. But I want to do something like this:

1. You power on the hypervisor box, this in turn powers on the individual VMs.

2. Now i login to the root shell of the hypervisor OS and login to the Gateway VM from the internal IP bound NIC on the VM ( Rem. that this VM has two NICs , one public and one internal)

3. Change the public facing IP of the VM

I hope this scenario makes my point a tad more clear. The major advantage that I'll have if this can be done is i can automate these steps using remote scripts which suits me better.

Thanks

dg

[kjb007]

If you want to be able to ssh from the hypervisor shell to the vm, then create a 2nd vmkernel interface on the internal only switch. With that, you should be able to use the dropbear client to connect to your public host. I would be careful here since you are allowing access from your public vm into your hypervisor. You could disable access from the hypervisor directly from the firewall, and have the connection jump from the esx hosts to the secondary vm's and finally to the public vm instead.

-KjB

VMware vExpert