3

I would like to place my VMware ESXi 4.1 server in a data center but I'm concerned that assigning a public IP to the host to enable remote management over the net (with VMware vSphere client or SSH) might leave the server vulnerable to attacks. Is there a better/safer way for a person with a limited budget to remotely manage a VMware ESXi 4.1 server over the net. Please note I do not have access to a firewall appliance to configure VPN.

1
  • 8
    you have means to pay for a server in a data center, but yet you cannot get your hands on a firewall?
    – gravyface
    Oct 14, 2011 at 0:46

5 Answers 5

3

There isn't any way to do this effectively. ESXi does have a firewall built in, so you could in theory lock down the management interface to your remote IP addresses, but if your IP address ever changes... too bad.

You need to have some way to VPN into the network and put the ESXi interface on a private network.

1

Have you considered a free firewall such as PFSense? You could consider running it as a VM on the same server if you didn't want to dedicate a box or possibly incur additional monthly costs in the datacenter.

2
  • would this allow me to secure the host or the guest machines?
    – jmm312
    Oct 14, 2011 at 11:25
  • @jmm312 - what you do is you install PFSense and then attach the public IP address to an interface inside PFSense. Then, on your virtual switch you attach the internal interface of pfsense, and enable the management interface on that internal switch. That way your management network is not exposed. This can also be used for protecting your entire virtual network and is what we've done a few times. Oct 17, 2011 at 0:17
1

Erm...

And if the reason ou want to connect to the ESXi host is because of a fault - or you need to shutdown the VMs to apply a patch or configuratino change to ESXi itself, but your only way in was through one of said VMs, don't you have a but of a problem?

1
  • Hi Dave, are you asking a follow up question here ?
    – user9517
    Oct 19, 2012 at 10:45
0

We have the same situation. We have a virtual machine running pfSense that we use for day-to-day access to VMware and to the virtual machines.

For emergency access, we're using a VPN service provided by our collocator which allows one user to login and gain only access to the management interface of VMware.

Our initial setup had a dedicated firewall device -- which is what I recommend you get if you can't get VPN access through your collocator. We don't do this anymore for the simple reason that it died.

0

I would say put the ESXi host on a private network and have some form of secure VPN access into the private network. Because then, you're not exposing the ESXi host directly to the public net. Someone would have to breach your VPN service first in order to even see the ESXi host. You decrease your likelihood of having your ESXi host exploited. I'd say use good password practice is an obvious one.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .