stopping iptables and restarting failing

[lawson23]

I was asked today to temporarily disable the firewall on ESX 3.5. Used command

service iptables stop

Problem is now I can't get the service restarted:

service iptables start

Any ideas?

[kooltechies]

Hi,

iptables doesn't play much role now in 3.5 , you should be using esxcfg-firewall command for firewall.

Thanks,

Samir

P.S : If you think that the answer is helpful please consider rewarding points.

[lawson23]

Ok I got this from this article but what command do I use to get this restarted?

http://support.vmware.com/selfsupport/s3portal.portal;jsessionid=vn0sJnrHNhWmgkLZB5Q2ycT0BGHHYf9wwFC...

???

service esxcfg-firewall start

[kooltechies]

Yes that should do.

Thanks,

Samir

[lawson23]

Unrecognized service returned

[Lightbulb]

esxcfg-firewall runs ontop of iptables (Which does tha actual work)

esxcfg-firewall should be used when manipulating the firewall rulsets (From cli).

Try the foollowing and post the output

esxcfg-firewall -q

[Lightbulb]

If it looks like your rules are not up try

esxcfg-firewall -l

Which should load the rulsets of the host.

[lamw · Accepted solution]

esxcfg-firewall is not a valid service id.

You'll need to do the following to actually start up esxcfg-firewall as it's been stated

/sbin/service firewall start

=========================================================================

--William

VMware ESX/ESXi scripts and resources at:

[lawson23]

# esxcfg-firewall -q

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)

pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)

pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)

pkts bytes target prot opt in out source destination

Incoming and outgoing ports blocked by default.

Enabled services: CIMSLP VCB CIMHttpsServer sshClient vpxHeartbeats LicenseClient sshServer symantecBackupExec

Opened ports:

[Lightbulb]

Firewall is wide open

Try lamw suggestion of service firewall start or you can try reloading the rules via esxcfg-firewall -l, dont have an ESX host in front of me right now to try them out.

[lawson23]

how long should this command take?

<code>/sbin/service firewall start
</code>

As it has been saying

starting firewall

Now for about 5 min.

[lamw]

It should be relatively quick, have you tried looking at the logs to see if there are other issues?

/var/log/messages

/var/log/vmkernel

/var/log/vmkwarning

/var/log/vmware/hostd.log

You might also want to try to restart the managment services, there could be something hosed up, this will not affect any running VM(s) on the system, though if you suspect the system might have some issues and you have the ability to vMotion the VM(s) that would also be a good idea.

service mgmt-vmware restart

=========================================================================

--William

VMware ESX/ESXi scripts and resources at:

[lawson23]

for some reason I believe this killed by putty session when doing this because when I clicked in the window and hit a key it said inactive.

So I reconnected and now the service appears to be running.

How do I verify for sure?

[lamw]

esxcfg-firewall -q

This will query the ruleset

/sbin/service firewall status

Should give you the same and provide a status

You should get familiar with the esxcfg-* commands, anytime you're unsure you can just run the command with --h or -h and it should provide you with a help menu

=========================================================================

--William

VMware ESX/ESXi scripts and resources at: