DJRyanJ
Contributor
Contributor

vSphere Client Can't Connect Over SSH Tunnel

I have a couple of ESX 4.0 servers sitting in a lab on campus, which is usually not where I am. Typically, I set up an SSH tunnel to connect remotely to my network and forward some ports over the tunnel and connect to things that way. I do this for a few reasons - 1) my network at work has all of 3 ports open; 22 (SSH), 80, and 443; 2) dumping everything over the SSH tunnel is just far easier and more secure than port forwarding a bunch of ports over the internet; 3) I'm rarely at the lab and working remotely is much better for me.

I don't have my vCenter server set up as yet, but it's on the todo list.

When I'm physically in the lab and connect to the IP's of the hosts, I can access things fine with the vSphere Client. When I try over the tunnel, it tells me I can't connect with a "vSphere Client could not connect to vCenter Server <name>. Details: A connection failure occured (Unable to connect to remote server)".

I have ports 443, 902 and 903 forwarded to the Service Console IP on the host.

Would it matter that the VMKernel port is on a separate IP?

Anyway, any help anyone can offer about getting vSphere Client running over an SSH tunnel would be fantastic.

Thanks in advance.

-r-

0 Kudos
18 Replies
MagicMonkey
Contributor
Contributor

I'm having problems too. I'm trying to connect to ESXi 4 with vSphere client over SSH tunnel. Forwarded 902, 903, 443 and it won't connect. I have forwarded ports to VM's on that box and I have no problems connecting to them.

When I open those ports in my NAT router I am able to connect.

0 Kudos
AndreTheGiant
Immortal
Immortal

Use OpenVPN or other VPN instead.

There are too much port to redirect, and also name resolution could be a problem with port forwarding in ssh tunnel.

Andre

Andre | http://about.me/amauro | http://vinfrastructure.it/ | @Andrea_Mauro
0 Kudos
MagicMonkey
Contributor
Contributor

Since it works when i open the ports in my NAT router, I should not have to forward more ports when SSH tunneling. I have used SSH tunneling without problems before when using the VI client.

0 Kudos
DJRyanJ
Contributor
Contributor

Also, OpenVPN or other VPN's are simply not possible in this situation.

Also, unless I miss my guess, name resolution is a moot point here given that I connect to everything using IP.

-r-

0 Kudos
CONV4-BETA
Contributor
Contributor

I also ran into the same problem.

We have several ESXi 3.5s (standalone) behind a firewall in the private IP range, and everything works just fine when SSH-tunneling port 443 and 902 and connecting to localhost.

After upgrading VI client to vSphere I cannot anymore connect to the ESXi's with the upgraded client when usng SSH tunneling. In the error message it mentions the DNS reverse-resolved name of the workstation I'm running vSphere on.

I still can connect to a ESXi which has the 443 and 902 ports open (and NAT'ed). Of course when vSphere client is put on the same subnet as the ESXi's, everything works fine.

0 Kudos
nickbertrand
Contributor
Contributor

I was able to get it to work by adding a line to the C:\WINDOWS\system32\drivers\etc\hosts file:

127.0.0.1 esxserver

Nick

DJRyanJ
Contributor
Contributor

Hm, an interesting solution, especially given that one of the error messages pops up saying it can't connect to server "localhostname" (where localhostname is the DNS name of the local computer) even though I'm specifically pointing it at 127.0.0.1.

However, this didn't work for me. I assume that your "esxserver" name is actually the dns name of the far server?

-r-

0 Kudos
CONV4-BETA
Contributor
Contributor

Great, worked for me!

Port 902 though still seems to be required for data transfers (VM consoles, datastore etc)

Thx!

0 Kudos
DJRyanJ
Contributor
Contributor

Scratch that, it did work.

The caveat is that you have to connect using the actual DNS name of the server and NOT 127.0.0.1; this is why the "hosts" file works. It also allows you to connect to a vcenter server the same way, not just ESX.

My hosts file:

127.0.0.1 esx1 esx2 vcenter

That allows me to connect to any of them just by moving my tunnel destination around.

Of course, when on the local subnet, it's a good idea to remove or comment out the entries in hosts, otherwise it'll still fail. :smileysilly:

Thanks!

-r-

0 Kudos
CONV4-BETA
Contributor
Contributor

You don't need to use a real DNS name.

The thing is that vShere client seems to treat 127.0.0.1 or localhost in a special way, but any other name resolved to 127.0.0.1 works

0 Kudos
rikske
Contributor
Contributor

Instead of using 127.0.0.1 use 127.0.0.2 this way the

connection works without modifing hosts file etc.

The ssh command looks like this:

ssh -L 127.0.0.2:443:@<ssh_server

When using putty add: 127.0.0.2: to the source port.

When the ssh connection is established you can use 127.0.0.2 as the host to connect to using the vSphere client.

Message was edited by: rikske

0 Kudos
packetgod
Contributor
Contributor

Say I just tried this with ports 443, 901, and 902 forwarded and it didn't work. When I setup an entry in my hosts file as suggested it worked great with no other changes, not sure why ip doesn't work but hostname does.

Thanks much for the help!

0 Kudos
GarryG
Contributor
Contributor

Can't get it to work, even with the hosts change ...

Main problem seems to be that the new VIclient changes "localhost" or 127.0.0.1 to the regular local IP of your machine, thus not going through the tunnel (noticed that by the access shown by my firewall). Also, after changing to something else, like "tunnel", for the console it will still do a lookup based on the VM name, which again messes up the tunnel access ...

I guess I will have to resort to a regular VPN for the site I need access to, as neither the web-based console nor the VIclient seems to work ... Smiley Sad

0 Kudos
dc1975
Contributor
Contributor

After some test the final solution who full worked for me is :

1) connect to ESXI server with putty with forwarded ports 443 and 902 (see putty ssh tunel procedure on the web) -  note port 903 is not necessary.

2) open file C:\WINDOWS\system32\drivers\etc\hosts with text editor.

3) add a name that you want after "127.0.0.1 localhost" on same line and save the file

    eg.    127.0.0.1  localhost  localvsphere

4) With vSphere Client connect to your esxi server by use nameserve you add on hosts file  (eg. "localvsphere")

that all !  Smiley Wink

0 Kudos
L1quid
Contributor
Contributor

Port 903 is necessary if you want to use the VM console.

0 Kudos
natan770
Contributor
Contributor

I confirm that.

I've just added this line to my hosts file:

127.0.0.1   esxi

(where esxi is the name of my remote ESX host), and it worked out.

Great suggestion, guys...

0 Kudos
nextar
Contributor
Contributor

There is a simplest way to do this if you trust in your network. You don't need to mess with your host file, just check the radio box

putty.png

"Local ports accept connections from other hosts" in Putty at the tunnel settings.

0 Kudos
zstar69
Contributor
Contributor

THE SOLUTION:

vCenter get's messed up if you are tunnelling and trying to use "LOCALHOST" to connect.

Open your hosts file,

change 127.0.0.1 localhost

to:

something like (just for example)

127.0.0.1 localhost2

will make it work.

Something about "localhost" makes ESXI not try to use the tunnel, but rather it literally tries to connect to itself, even with an established tunnel. AND even if https://localhost brings up the vCenter page! So don't be thrown off and say "IT'S WORKING CUZ I CAN HIT THE WEBPAGE" Same problem here, changing from localhost to something else fixed for me.

0 Kudos