Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is the best option to restrict access to ESXi machine so that it could be managed using VSphere client from only certain hosts?

I know there is no built-in firewall and everyone recommends placing an ESXi machine behind a firewall, but when this is not an option... Is there any other option like using hosts.allow/deny or anything else? Or I better use ESX instead of ESXi?

Edit: In the given circumstances, I am not able to add any additional hardware or use things like managed switches.

share|improve this question
In your (updated) situation as described, you're just out of luck; ESXi is so stripped down and doesn't include iptables, you'll not really get there from here if you know what we mean. You really need ESX which has the appropriate tools, or you need to add other hardware (whether it be a firewall, managed switch or even cheap linux box running iptables) to get what you want. There's a reason ESXi is free I guess... – troyengel Jan 2 '10 at 21:33

Would it be possible to configure the networking of the ESXi machine to create static routes matching those IP addresses or blocks, and route them to localhost? That would effectively eliminate the chance of traffic passing back to those hosts.

share|improve this answer

If the ESX host is plugged into a managed switch, you could possibly build an access list to allow access from specific hosts to whatever destination port vsphere listens on and then deny all other hosts.

share|improve this answer
Unfortunately, I am not able to use managed switch or any additional hardware. – kdl Nov 19 '09 at 20:25

I've thought about this today, and whilst it isn't exactly what you wanted, its the best I think I could come up with.

  1. Setup 2 Networks, one interface pointing to the untrusted network, the other not connected to a physical interface called "Trusted Network"

  2. Install a Firewall Solution with VPN built into it (such as Smoothwall) with the RED network pointing to the untrusted network interface, and an static IP address from the untrusted network address range

  3. Create a NEW VMKernel interface inside the trusted network you just created.

  4. Create a Port Mapping through from the untrusted network to the trusted network with source address permissions

  5. Run Vsphere client pointing to the new VMKernel interface inside the trusted network via the port mapping on the firewall

  6. Delete the VMKernel running on the untrusted interface.

  7. Drink a Cool Amber Fluid, because its friday and your just solved a good problem.

share|improve this answer
Yep, that's exactly what I thought of and tried. What stopped me was a glitch (was it?) when I left two vmkernels and after a reboot the one connected to the untrusted network 'borrowed' DNS settings from the other one and I lost all connectivity. Gotta try it again. – kdl Nov 30 '09 at 11:05
That's exactly one problem I had during testing, and I overcame it via directly changing it via the console screen. – Stephen Thompson Dec 1 '09 at 8:07

All access into the box will be via SSL and so long as you set a suitably complex username/password combo it'll be pretty hard to crack.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.