ESXi 3.5 update 5: VM's not reachable from external IP

[roderick44]

I recently started experimenting with ESXi 3.5 update 5. From my internal netwerk everything works like a charm, but from the outside my virtual servers are not reachable. Looks like ESXi blocks external ip's from accessing my VM hosts / network. ESXi shouldn't have a firewall and also the esxcfg-firewall command doesn't work. the esx.conf file doesn't have any firewall lines.

I know it has something to do with the management network or so... but seperating the hosts network and management network didn't solve the issue.

How do I disable ALL security for the management and host network? I know it's not the way, but I'd like to test it and have a external firewall anyway. Or if it's possible is it possible to enable some ports on the management network?

[roderick44]

just to clear the actual question: I can access my servers fine from the internal network, however I cannot access the web services or RDP from outside. looks like it has something to do wheter I'm internally or externally connected. I'm atm only using one NIC and like to set it up to use only one NIC for management and vm's. but how? ESXi keeps blocking (and I think it's because the management network is on the same net)

[weinstein5]

Welcome to the Forums - ESXi and ESX 3.5 do not block any traffic to the VMs - some questions:

• When you say internal network - are your referring to the physical network in your office or have you created an internal only network for the VMs? If it is the latter then no your will not be able to reach the VMs from the external network - you will need to connect the virtual switch to a physical NIC in your ESXi host.

• I think the issue is with the physical router between the outside world and your VMs - Are the VMs able to get out to the external network? How are the VMs getting their IP addresses? Is the gateway configured properly?

If you find this or any other answer useful please consider awarding points by marking the answer correct or helpful

[roderick44]

I know they do not block any traffic, that's why I don't understand why they are not connectable from the outside world and I thought it had something to do with the management network.

When I say internal network I mean the network behind the router. The network on the IP range 10.x.x.x. When I say external network I mean the internet. There is no internal network for the VM's only. I've configured only one vswitch (the one that configured default after installation) and the VM's are connected to that. I'll put a screenshot in this post so you can see it. It's very basic and a one NIC network for ESXi. Even when I had a second vswitch with seperate NIC and lan cable attached the problem stayed the same. I should note that both the networks are one the same subnet and gateway, only the ip address was different.

I've used VMware sever before and that was no problem connecting from the external network (the internet).

The VM's are able to connect to the internet at first the VM's were configured using DHCP and now they are static. I was never able to connect to them from the external (internet) network.

[roderick44]

problem solved: put in an extra NIC and created another vSwitch and now they will connect. So VMware ESXi doesn't have a firewall but it blocks VM's on the management network from external clients!!

[roderick44]

and so I thought the problem was solved: it isn't. the weird thing is one of the VM's is now working responding to the external IP address, the rest of the VM's won't. Somebody please help! I'm out of ideas right now...

[weinstein5]

You need to make your router is configured to translate the Public IP address to an IP address on the Internal network so the traffic can be routed to that internal address - typically this is a 1 to 1 relationship but if your router allows pointing different ports (e.g. 80, 25, 443) to different IP address then you can have that single public address route the traffic to the approriate application running on your private network requiring the necessary port -

If you find this or any other answer useful please consider awarding points by marking the answer correct or helpful

[roderick44]

finally problem is fully solved. I have a router that can route different ports to different internal ip's indeed. and ofcourse that was after a long night the problem. but how? well I think it's a fault in the routers firmware or so... what happened was: I've checked my router for thousends of times and the configuration was correct. DMZ setup correct, ports forwarded correct. because I still couldn't find a problem and the one VM was working I decided to reboot the router and see what it does. and what happens the router came back only with my OLD UNCHANGED configuration. I logged back in, changed the ports and this time the VM's were usable from the external (internet) ip. Weird, I guess it's a bug in the new firmware I flashed a few weeks ago.... well I do know this can keep you busy for quite some time until you reboot your router.... and in this case unfortunately my router works that well that I do not have to reboot it all!