vCenter Appliance 7.0.x Firewall rules

[ChrisI88]

We want to block all traffic to the vcenter appliance except for 1 IP address range.   

Is this even possible with the limited rule set provided ?   

Will adding a accept rule for the allowed IP range automatically block everything else or do I need a block all rule after the allow rule ?

I'm guessing a block all rule would be a IP address of 0.0.0.0 - but have no idea.  the documentation on the internal firewall on the appliance is very generalized.

Some examples in the documentation would be very helpful.

[vXav · Accepted solution]

---

We want to block all traffic to the vcenter appliance except for 1 IP address range.   

Is this even possible with the limited rule set provided ?  

Yes, you need to add an accept rule for your range and then a reject rule for 0.0.0.0/0 like you said.

---

Will adding a accept rule for the allowed IP range automatically block everything else or do I need a block all rule after the allow rule ?

No.

---

I'm guessing a block all rule would be a IP address of 0.0.0.0 - but have no idea.  the documentation on the internal firewall on the appliance is very generalized.

---

Correct, 0.0.0.0/0

I just ran the tests as I'd never tried before. Just in case you lock yourself out, you can edit the rules with the shell in /etc/vmware/appliance/firewall.conf and then reload with /usr/lib/applmgmt/networking/bin/firewall-reload. Although it might be cleaner/safer to do it at the actual firewall level.

[LuisFt]

Hi, 

I have these settings, but I still can open vCenter from other IPs like 192.168.0.20/24, any advice about what I'm doing wrong?
Settings

[burchell99]

you are using /24 which is the entire block of your 192.168.0.x

The rules are read in order so the first rule is allowing your 192.168.0.20 and it never reaches the deny

for a single IP you need the prefix to be /32

Note: this is untested but ive been researching the same today and that is my understanding

Subnet Cheat Sheet – 24 Subnet Mask, 30, 26, 27, 29, and other IP Address CIDR Network References (f...