Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to place my VMware ESXi 4.1 server in a data center but I'm concerned that assigning a public IP to the host to enable remote management over the net (with VMware vSphere client or SSH) might leave the server vulnerable to attacks. Is there a better/safer way for a person with a limited budget to remotely manage a VMware ESXi 4.1 server over the net. Please note I do not have access to a firewall appliance to configure VPN.

share|improve this question
you have means to pay for a server in a data center, but yet you cannot get your hands on a firewall? – gravyface Oct 14 '11 at 0:46

There isn't any way to do this effectively. ESXi does have a firewall built in, so you could in theory lock down the management interface to your remote IP addresses, but if your IP address ever changes... too bad.

You need to have some way to VPN into the network and put the ESXi interface on a private network.

share|improve this answer

Have you considered a free firewall such as PFSense? You could consider running it as a VM on the same server if you didn't want to dedicate a box or possibly incur additional monthly costs in the datacenter.

share|improve this answer
would this allow me to secure the host or the guest machines? – jmm312 Oct 14 '11 at 11:25
@jmm312 - what you do is you install PFSense and then attach the public IP address to an interface inside PFSense. Then, on your virtual switch you attach the internal interface of pfsense, and enable the management interface on that internal switch. That way your management network is not exposed. This can also be used for protecting your entire virtual network and is what we've done a few times. – Mark Henderson Oct 17 '11 at 0:17


And if the reason ou want to connect to the ESXi host is because of a fault - or you need to shutdown the VMs to apply a patch or configuratino change to ESXi itself, but your only way in was through one of said VMs, don't you have a but of a problem?

share|improve this answer
Hi Dave, are you asking a follow up question here ? – Iain Oct 19 '12 at 10:45

We have the same situation. We have a virtual machine running pfSense that we use for day-to-day access to VMware and to the virtual machines.

For emergency access, we're using a VPN service provided by our collocator which allows one user to login and gain only access to the management interface of VMware.

Our initial setup had a dedicated firewall device -- which is what I recommend you get if you can't get VPN access through your collocator. We don't do this anymore for the simple reason that it died.

share|improve this answer

I would say put the ESXi host on a private network and have some form of secure VPN access into the private network. Because then, you're not exposing the ESXi host directly to the public net. Someone would have to breach your VPN service first in order to even see the ESXi host. You decrease your likelihood of having your ESXi host exploited. I'd say use good password practice is an obvious one.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.