Block ssh and ICMP for VMs on VDS

[vSohill]

Hi,

Can I stop ssh or ping to some VMS fro VDS PortGroup ?

[MKguy]

If you're on 5.5 or later you can use the traffic filtering feature of the VDS, which allows you to define basic ACLs based on Layer 2 and 3 Source/Destination as well as layer 4 ports. Note that you need to use the Web Client to access these settings in the VDS.

Refer to the documentation for more information on how to enable traffic filtering:

Filter Traffic on a Distributed Port Group or Uplink Port Group

I would prefer implementing a proper firewall though.

[Dee006]

I prefer you to use the vshield or any virtual firewall VM in front of your VM to restrict the port policy incase you don't have facility in your firewall.

vShield Available as standlone with vsphere 5.5 or less and vSphere 6 onwards you need to use the along with NSX.

[vSohill]

Can VDS do that without VNS or NSX ?

[vSohill]

from this opetion i can drop icmp , But how can i drop ssh ?

[MKguy · Accepted solution]

You have to select the appropriate layer 4 transport protocol, which is TCP in this case. Then you can enter the layer 4 destination port to match, which is port 22 for SSH:

[vSohill]

Great, Thank you.

In my screenshot, Does the ACL will be applied for port ID 16 only, mean only the VM that linked to port 16 not the others VMs and the PG. Am I assuming right ?

[MKguy]

Yes, rules defined on individual dvports only apply to that dvport and not to the entire port group.

Just be aware that with filtering both Ingress/Egress, your VM will not be able to establish outboud SSH connections either. If you just want to filter SSH connections TO and not FROM the port you need to set the rule to Egress only as Egress/Ingress traffic is always seen from the VDS point of view.

[vSohill]

Thank you