Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am playing with vmware ESXi v5 and installed a Win XP 32bit as one of the VMs inside.

I wish to block outgoing access (especially http) from the VM (maybe some form of firewall?), yet still allow:

  1. Entry to the VM via RDC
  2. Sharing of files or other features with other VMs (perhaps meaning within LAN) in the host kind of like via Workgroup. (this might need a seperate question)

Any ideas on how can I do the above? Still very new in VM-ing! But willing to learn! :)

share|improve this question
up vote 1 down vote accepted

I'd suggest one of the VMWare vShield products, perhaps 'App' or 'Edge' - take a look, there's lots of options.

share|improve this answer
Does it mean it can't be done on ESXi directly? – RicL Nov 18 '11 at 14:03
vSwitches are just that, layer 2 devices, they don't even know it's IP you're using, hence why they offer those products as options - many people want to do that kind of thing either in the OS or on the network. I'm no XP expert, doesn't it have its own built in firewall? I know Server 2008 does. – Chopper3 Nov 18 '11 at 14:04
@Chopper3 there's also quite a few ready to go firewall appliances; I know pfSense 2.0 has a VMware appliance with a nice Web GUI. – gravyface Nov 18 '11 at 14:20
I don't want to rely on the firewall atm, instead I want to block it from outside the guest os. vSwitch is in vSphere Client > Configuration > Networking right? I studied left and right but doesn't seem to have any way to block http traffic according to the requirements I mentioned. – RicL Nov 18 '11 at 14:22
@RicL, Chopper already answered that part of the question...vSwitch are plain Layer2, the only thing they know about are MAC addresses. You WILL need a firewall of some kind to achieve your goal. – Alex Nov 18 '11 at 14:26

Assuming that your Windows XP VM is bridging to a physical interface on your ESXi box or part of a virtual switch connected to a physical interface on your ESXi box you have a few choices.

  1. You could use the Windows XP firewall to control inbound and outbound network connections. This would be the quickest way to do this without changing any ESXi settings. You can read more here

  2. You could build another VM or use a Virtual Applicance that would operate as a network firewall. You would then need to create two virtual switches. One that would be connected to your physical server interface and one of the interfaces on the firewall VM. You could note this as your "Outside Interface". Then one virtual switch that connects to the second interface on your virtual firewall VM and the interface of your Windows XP VM. You could note this as your "Inside Interface". The tricky part here is if you choose to NAT or route the traffic between your inside and outside. It may be easier to NAT the traffic and port forward the remote desktop connections, or you may feel comfortable advertising a new route to the subnet on the Inside interface. Some virtual firewall appliances may allow operation as a bridged firewall if so you could run the same subnet for the inside and outside interfaces, this may require extra work on the virtual switch to allow proxy ARP or permiscious traffic.

  3. You could place a firewall device between the ESXi physical connection and what ever network you are attached to.

share|improve this answer
Hi! Thanks for your answer. 1) Not an option atm. 2) So meaning, this other VM is installed specifically just to manage the network? I did create 2 vswitches but not 2 VMs :) The NAT parts are quite confusing since I don't seem to be able to find any articles about this on ESXi 5. Inside my network adapter I can't set it to bridged as well; there is only E1000, VMXNET2, 3 and Flexible for the adapter and specifying the Network Label. – RicL Nov 18 '11 at 14:28

Where do you want to block it from? If the machines (VMs) are configured with bridging, you can block access at the firewall, or set up a firewall on your network to filter traffic.

Another option is to create a VM with Linux, install firewall software on it, then set your other VM's to use it as the gateway to the Internet (use proxying and forwarding on the Linux VM to send traffic to your "actual" gateway.)

share|improve this answer
Set up a firewall on my network; would that mean on my router? – RicL Nov 18 '11 at 14:29
Only if your router supports firewall rules. Some do, some don' didn't really describe your complete configuration. You might be best off with a VM acting as a firewall and configure your other systems to use it as a gateway. – Bart Silverstrim Nov 18 '11 at 14:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.