Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working on creating some firewall rules to stop some of the SSH brute-force attacks that we have seen recently on our ESX server hosts. I have tried the following rules from the CLI to first block all SSH traffic and then allow the two ranges that I am interested in:

esxcfg-firewall --ipruleAdd,22,tcp,REJECT,"Block_SSH"
esxcfg-firewall --ipruleAdd,22,tcp,ACCEPT,"Allow_PUBLIC_SSH"
esxcfg-firewall --ipruleAdd,22,tcp,ACCEPT,"Allow_PRIVATE_SSH"

However, these rules are not working as intended. I know that if you do not enter the block rule first, then the allow rule will not be processed. We are now having the issue where the first entered allow rule is being ignored such that the block rule works and the last entered allow rule works. I was curious if anyone had any ideas on how I could allow a few different ranges of IP's with the esxcfg-firewall --ipruleAdd command? I am at a loss and am having a hard time locating examples or further documentation about this.

Thanks in advance for your help with this.

share|improve this question
For what it is worth, I have found the following links that shed a little more light on the issue, but I am still confused about how to make this work. Please feel free to help out if you can in explaining the order the rules need to be entered or how to accomplish the aims of my original posting. Link 1: and Link 2: – John Dec 13 '10 at 19:26
Usually deny rules go towards the bottom. – SpacemanSpiff Dec 21 '10 at 3:28

It's not a firewall, but why not just change the port SSH runs on? It won't stop any brute force attacks that are directed at you specifically, but it will prevent the random bots that roam the internet performing these attacks. It seems quite straightforward to do:

share|improve this answer
The other system administrators that I work with are not keen on changing the port the service operates on. I would support this idea as well if they were on board with it. However, a different solution will need to be found. Additionally, it seems that the issues is more of a bug/flaw with how VMware allows the rules to be entered. I still have no answer for this issue. – John Feb 2 '11 at 17:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.