Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to place my VMware ESXi 4.1 server in a data center but I'm concerned that assigning a public IP to the host to enable remote management over the net (with VMware vSphere client or SSH) might leave the server vulnerable to attacks. Is there a better/safer way for a person with a limited budget to remotely manage a VMware ESXi 4.1 server over the net. Please note I do not have access to a firewall appliance to configure VPN.

share|improve this question
8  
you have means to pay for a server in a data center, but yet you cannot get your hands on a firewall? –  gravyface Oct 14 '11 at 0:46

4 Answers 4

We have the same situation. We have a virtual machine running pfSense that we use for day-to-day access to VMware and to the virtual machines.

For emergency access, we're using a VPN service provided by our collocator which allows one user to login and gain only access to the management interface of VMware.

Our initial setup had a dedicated firewall device -- which is what I recommend you get if you can't get VPN access through your collocator. We don't do this anymore for the simple reason that it died.

share|improve this answer

Erm...

And if the reason ou want to connect to the ESXi host is because of a fault - or you need to shutdown the VMs to apply a patch or configuratino change to ESXi itself, but your only way in was through one of said VMs, don't you have a but of a problem?

share|improve this answer
    
Hi Dave, are you asking a follow up question here ? –  Iain Oct 19 '12 at 10:45

Have you considered a free firewall such as PFSense? You could consider running it as a VM on the same server if you didn't want to dedicate a box or possibly incur additional monthly costs in the datacenter.

share|improve this answer
    
would this allow me to secure the host or the guest machines? –  jmm312 Oct 14 '11 at 11:25
    
@jmm312 - what you do is you install PFSense and then attach the public IP address to an interface inside PFSense. Then, on your virtual switch you attach the internal interface of pfsense, and enable the management interface on that internal switch. That way your management network is not exposed. This can also be used for protecting your entire virtual network and is what we've done a few times. –  Mark Henderson Oct 17 '11 at 0:17

There isn't any way to do this effectively. ESXi does have a firewall built in, so you could in theory lock down the management interface to your remote IP addresses, but if your IP address ever changes... too bad.

You need to have some way to VPN into the network and put the ESXi interface on a private network.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.