Approaching the ESXi Firewall: Don’t Let the Web Interface Fool You
If you are managing a cluster of dozens of hosts, using the vSphere Client to configure firewalls one by one is like “digging with a spoon.” The Graphical User Interface (GUI) is very intuitive for beginners. However, as the system scales, repetitive clicking only leads to mistakes and wastes time.
The firewall on ESXi has a very specific mechanism. It is a stateless filter based on services. Unlike iptables on Linux, you cannot arbitrarily add any rule; you must work based on existing Rulesets.
- vSphere Client: Suitable for quick checks or editing one or two individual rules.
- esxcli: The ultimate tool for automation. It helps you configure in bulk via SSH or scripts with absolute precision.
Why is esxcli the Choice of Professionals?
Advantages in Speed and Consistency
The biggest advantage of esxcli is its reusability. Instead of spending 5 minutes logging into the web and navigating menus, it takes me only 3 seconds to paste a command line. In production environments, I often save these commands in .sh files. When adding a new host, I just run the script to ensure the configuration matches the current system 100%, completely eliminating manual errors.
Syntax Barriers
The only downside is that its syntax is quite long and dry. Just typing one character wrong in a ruleset-id will cause an error, or worse, you could lock yourself out of the host by accidentally blocking the SSH port. The ESXi firewall is very strict by default; you are forced to follow predefined Service IDs instead of creating free-form rules like on Cisco or Fortinet.
Hands-on Firewall Configuration with esxcli
To start, enable SSH on the host and access it via Terminal. Below is the standard workflow I usually apply.
1. Checking Firewall “Health”
Before making changes, check the current status of the system:
esxcli network firewall getTypically, Default Action should be DROP and Enabled must be true. If the firewall is off, your host is exposed to security risks. Turn it on immediately:
esxcli network firewall set --enabled true2. Managing Rulesets (Service Lists)
Every service on ESXi (SSH, vMotion, Web Access) resides within a Ruleset. To list them all, use the command:
esxcli network firewall ruleset listYou will receive a list with Name and Enabled columns. Pay attention to important IDs like sshServer or vpxa (for vCenter).
3. Opening/Closing Service Ports in a Flash
Suppose you need to enable the SSH service for remote maintenance:
# Enable SSH service
esxcli network firewall ruleset set --enabled true --ruleset-id=sshServer
# Disable Web Access (Block vSphere Client access via host IP)
esxcli network firewall ruleset set --enabled false --ruleset-id=webAccess4. Limiting Access IPs: A Vital Security Layer
This is the most critical part of host protection. By default, when you open a port, ESXi opens it to the entire world. This is extremely dangerous if the host has a public IP or is on an insecure internal network.
I always apply the “White-list” principle. For example: Only allow the management workstation (192.168.1.50) and the management VLAN range (10.10.10.0/24) to access SSH.
# Step 1: Block access from all IPs
esxcli network firewall ruleset set --allowed-all false --ruleset-id=sshServer
# Step 2: Specify allowed IPs
esxcli network firewall ruleset allowedip add --ip-address=192.168.1.50 --ruleset-id=sshServer
esxcli network firewall ruleset allowedip add --ip-address=10.10.10.0/24 --ruleset-id=sshServer
# Re-check the whitelist
esxcli network firewall ruleset allowedip list --ruleset-id=sshServer5. The Custom Port Issue
You cannot use esxcli to create an arbitrary port like 8080. The ESXi firewall loads configuration from XML files at /etc/vmware/firewall/. If you install third-party applications, you must create a new XML file here. However, be careful: these files will be lost upon rebooting the host unless you package them into a custom VIB.
Real-world Lessons from Operations
After years of managing VMware systems, I have derived three golden rules to avoid risks:
- Don’t lock yourself out: Before applying
--allowed-all false, ensure the IP you are using has been added to the allowed list. - Parallel testing: Always keep an active SSH session running and try to open a new session from another machine to test the rule. If it’s wrong, you still have the old session to fix the error.
- Controlled automation: Group your
esxclicommands into a Bash script. This allows you to deploy 10 hosts as fast as 1 without worrying about forgetting any security steps.
Mastering esxcli not only makes your job easier but also affirms your system administration expertise. Good luck with your secure system configuration!
