0

I need to setup a VM on VMWare ESXi 6.0 that would have internet access but without any LAN access.

This is for an external user to remotely login to machine and work using the internet who shouldn't have any access to the LAN.

The network is setup in a simple way. The router is a Huawei HG8244H and is setup as 192.168.1.1 / 255.255.255.0, without any Microsoft ISA server, I thought about:

  1. changing the router network mask to 255.255.0.0
  2. setting the "external user" VM in the 192.168.2.x network.
  3. Adding a Linux VM with two IP addresses (192.168.1.x and 192.168.100.x) with iptables to forward any traffic from the first VM directly to the router and blocking all other access to the .1 network.

This seems like overkill, so I'm looking for a simpler solution. Thanks in advance!

Improve this question
2
  • You need to show us your virtual switch configuration on the ESXi host/s - also what OS do you want the VM to be?
    – Chopper3
    Dec 6, 2016 at 17:34
  • Does your router support VLANs? Are there any switches between your router and ESXi host and if so, do they also support VLANs?
    – virtex
    Dec 6, 2016 at 17:39

4 Answers 4

Reset to default
5
+100

The options of the router you use (Huawei HG8244H) seems to be limited.

The most simple solution would be adding small VM and redirect all traffic through that VM.

I would install a small DD-WRT guest ( http://www.casler.org/wordpress/?p=15 ). It is really light-weight compared even compared to a minimal popular linux distro.

Configure the DHCP-server on the dd-wrt to hand out IP adresses in a different IP range.

Connect the dd-wrt WAN interface to your current network. On the LAN interface connect an internal lan network only used by the dd-wrt router and the isolated guest.

Configure port forwarding on both routers (huawei and dd-wrt) for the desired ports and you are good to go.

Verify that other network nodes are unreachable from the isolated host and if not change the firewall rules on dd-wrt accordingly.

Note: Any other router virtual appliance with the same features would suffice. I just had personal experience with the dd-wrt appliance in the past.

Improve this answer
2
  • I've used this vm in a lab (emulating an ISP setup with 2 CSR1000vs, 2 of these vms and 2 fedora desktops)
    – Jacob Evans
    Dec 7, 2016 at 0:51
  • This is a great solution, and nearly the same as what you considered overkill. You can't do much less and still have a good level of control and security. Another choice for virtual router is pfSense - also lightweight, free and very configurable. I would go so far as to replace the HG8244H with this for your entire network b/c you can add as many virtual interfaces and routing rules as you like.
    – Jens Ehrich
    Dec 9, 2016 at 17:17
0

You can put the VM in the DMZ. I would separate the network port on your ESXi host and create a separate vSS with the dedicated DMZ vmnic. Add your VM with a static IP to this VM. On your router, create a new DMZ rule with the VM's static IP as the host address.

I can advise that changing the subnet mask to 255.255.0.0 will serve no purpose.

Improve this answer
2
  • If an administrator logs in into the machine, he can simply change the IP configuration back to DHCP and then he can access all other network nodes...
    – eKKiM
    Dec 9, 2016 at 14:14
  • Not true, if he gets an IP from DHCP different from the DMZ IP, then the computer can't be remoted into because the NAT rule applies only to the static IP. Plus, if the vSwitch is set up as a separate virtual and physical network, then you have proper network segregation. Therefore, changing an IP would cause the VM to lose access until an ESXi admin could console and fix it.
    – Jarrod L. J. Gibson
    Dec 9, 2016 at 15:38
0

The easiest way to do that is to have a separate network interface in the ESXI host (NIC2), create a VirtualSwitch2 on NIC2 and cable NIC2 to your DMZ. put the VM you want this person to reach on VirtualSwitch2.

If you have multiple exterior IP's, set firewall rules to route all traffic to that IP to the one host in the DMZ.

If you don't have multiple external IP's available, give them a special port to RDP to other than 339 say 3339 redirect that to the 339 on the host in the DMZ.

The problem with doing a router only config is that you also say you don't want there to be any way to get back to the local lan. By giving this device its own virtual switch on ESXI, there is no way for them to see any traffic other than traffic on the DMZ. If you don't put the device into some sort of DMZ that wont be the case. If your router cant segment out a port and call it a DMZ then you should stop using home level gear for what sounds like business usages.

Improve this answer
2
  • This is what I have done for my environment. My VMware servers have copper NICs that are connected to their own vSwitch for DMZ guests. 10G CNAs are for internet use and on their own vSwitch. Your router has a DMZ mode; you should be able to drop a NIC in the server or use an unused one, create a virtual switch that is connected only to the DMZ port on the router. This allows you to build other VMs that are on the DMZ as well. If you like, you could even build a firewall/router connected to both vSwitches.
    – Dacid Salin
    Dec 9, 2016 at 22:59
  • @Bitterrooter just as a general thing, I could maybe see running 10Gcopper between internal hosts at an enterprise level, but not to an externally facing interface. Especially because that external interface is your bandwidth bottleneck (100mbit Internet < 1Gbit standard networking < 10Gbit copper), not the link between your vSphere environment and your DMZ. While people make youtube instructions for 10G home brew routers at a cost of a few hundred dollars why would spend any money to attach to a interface which is still 10x slower than the 1G interface freely available?
    – Rowan Hawkins
    Dec 10, 2016 at 20:26
0

Er, that was a typo. 10gb CNAS for...internal...use. using copper 1G on the external.

I added a 2port card to each ESXi server for the DMZ hosts. Have 2 DMZ switches and all servers have a connection to each.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.