I've been scratching my head on this issue the past few weeks. I've been searching but can't find the answer I want. Maybe I'm just bad at searching though. In any case, any feedback on this issue is welcome.

I'm running ESXi 5.5 (free) with five guests (more to come in the future). I have six public Internet ip-addresses that are routed to the physical port on which my server is connected.

What I want to achieve is this setup:

  • Host has ip-address X.Y.Z.10
  • Guest A has ip-address X.Y.Z.11
  • Guest B has ip-address X.Y.Z.12
  • Guest C has ip-address X.Y.Z.13
  • Guest D has ip-address X.Y.Z.14
  • Guest E has ip-address X.Y.Z.15

Currently this is achieved by configuring the ip manually on every guest. However, I want to make it impossible for Guest C to snatch the address of Guest B by changing the guest network configuration. X.Y.Z.12 should be available to Guest B only. The local administrator of each guest must have root access to its own machine.

Is this possible with ESXi alone or do I need to route all traffic through a VM running pfsense, iptables or similar? There is currently no firewall between the host machine and the Internet.

Thanks in advance.

Edit: To clarify the situation...

I have purchased my own server and I've then put it in a serverhall under a co-location agreement. In the agreement I also purchased a total of six ip-addresses. The server itself has two physical Ethernet ports, albeit only one is connected to the physical switch. The ip's are tied to my port of the physical switch, thus anything on my side that poses as ip X will get that ip, if that makes sense.

The guests are running different linux flavours, mostly Debian. Since it is my own server, resources are not an issue. Additional VM's can be put up at any time.

I understand that root administrators of the guest os's are able to edit the network files, but even if they can I don't want them to be successful. What that means is that if they change their network configuration it shouldn't work because they only have one of the ip's assigned to their virtual nic, not all of them.

Edit 2 Current configuration after VyOS setup (see comments)

vSwitch Setup

  • vSwitches exists in the free version. However I've been unable to set it up the way I want, hence why I'm asking if it is possible at all or if I should just move on to an alternative solution. From what I understand, ESXi is a mere VM host and does not care what is hosted in the VM container so I thought maybe it wasn't even possible.
    – user84273
    Dec 9 '14 at 14:25
  • Well, just off the top of my head (without having tested this, mind you), I'd set up a vSwitch for each external address, and then assign the guest's NICs to the vSwitch corresponding to the external address you want them to have. You don't generally deploy six /32 subnets, but I don't see any reason that wouldn't work. Dec 9 '14 at 14:34
  • 1
    vSphere doesn't have purview of the operating system and settings of the guest virtual machines (AFAIK), so I don't see how it would be possible to do this with any vSphere tool or setting. In addition, I don't see how it would be possible to give someone root access and at the same time deny their ability to perform root functions, like change the ip address in the guest Operating System.
    – joeqwerty
    Dec 9 '14 at 16:20
  • @HopelessN00b, Just to clarify do you mean you'd then set up an additional routing appliance (vyatta/vyos, pfsense etc) and use that to NAT to internal subnets? Would that not then limit the guest's ability to manage their own public IP address? How would you otherwise bridge the vswitches to the public subnet? Potentially you could use Vyatta/vyos as a switch and create ACLs between ports, so that you'd effectively only allow traffic from the one public IP on each vyatta/vyos port / vswitch pair, this would then allow your customers to configure their own ports and firewall setups.
    – Alex Berry
    Dec 9 '14 at 16:55
  • @AlexBerry Oh, yeah, I assumed there was a switch or router or something between the hosts and the internet connection, such that you'd use VLANs or ACLs control the external IP address a given vSwitch would be able to access. Dec 9 '14 at 17:02

I solved this by installing VyOS on a virtual machine acting as gateway. The machine had one interface connected to the Internet-switch (in ESXi (vSwitch0)) and then one interface per client machine (connected to their own separate switch). What I did then was to set up a private network on each client interface (using the range) and run a 1-1 NAT so that the public ips are forwarded to the internal client.

The steps used to accomplish a 1-1 NAT is all covered in the official documentation here: http://vyos.net/wiki/User_Guide#1-to-1_NAT

While this setup is not exactly what I wanted in the beginning (I wanted the clients to be able to set the public ips directly on their nics), it does provide the functionality I want by preventing clients from snatching other ips than their assigned ones.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy