1

I have an esxi6 host on public ip. All other VMs are behind pfsense firewall, so no issues.

I can't put esxi behind that because I don't want to get locked out.

So far I have disabled ssh access to esxi host.

Now for other security I just want to block ping messages to public ip of esxi host that no one knows if that ip is alive so that no one so any brute force attacks etc.

Is there any way I can block ping messages?

  • 2
    Blocking pings will not stop brute force attacks. Bots don't care if you have pings or not, they try every IP address. – Michael Hampton Feb 18 '17 at 1:00
  • Still i would like to do that. Also what i am thinking is put firewall rule to allow access from specific list of ips like home , work , vpn , other servers etc . i just want to do things which i can do to reduce such attacks – user3214546 Feb 18 '17 at 1:30
  • Blocking pings is still useless to prevent attacks. Nobody is going to be fooled. A proper firewall would certainly be better. – Michael Hampton Feb 18 '17 at 1:42
  • @MichaelHampton. do you know which services / ports i need to block public access to reduce attacks. I will only allow them from predefined ips like , home, office, friend so that in case all vm go down. i can still log into web clien – user3214546 Feb 18 '17 at 5:10
  • @MichaelHampton i enbaled ssh with private key only and for all other services in esxi i put my home ip address in esxi firewall. will that be enough. – user3214546 Feb 18 '17 at 7:58
1

There is an ESXi firewall that will give you all kinds of power, if you can master its arcane configuration https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2005284

see page 34 of the Security Guide pdf: http://pubs.vmware.com/vsphere-50/topic/com.vmware.ICbase/PDF/vsphere-esxi-vcenter-server-50-security-guide.pdf

I know this isn't a full answer but I hope it will help you in the right direction.

PS, "I can't put esxi behind that because I don't want to get locked out." - if you have good pfsense NAT rules you can be very secure (or at least much more obscure) and you won't get locked out.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.