Troubleshooting the ESXi Firewall

by admin

I’ve written previously about working with the ESXi firewall, including changing rules and setting security levels. This post will have a look at troubleshooting the ESXi firewall.

You can use both the vSphere client and esxcli to help you when troubleshooting.

Troubleshooting the ESXi Firewall using the vSphere Client

Using the vSphere client, go to the host’s Configuration tab, then click on Security Profile. Under ‘Firewall’, click properties to view the firewall rules:

esxi-firewall-properties

Using this console you can enable and disable various services, and change where you want to allow connections to the host from, on a port/service basis:

esxi-firewall-settings

Troubleshooting the ESXi Firewall with ESXCLI

ESXCLI offers a lot in terms of helping you troubleshoot the firewall. To start with you can view the status of the firewall by running:

~ # esxcli network firewall get
   Default Action: DROP
   Enabled: true
   Loaded: true

You can unload and load the firewall module, though the firewall will need to be disabled first, if you want to unload it:

~ # esxcli network firewall set --enabled false
~ # esxcli network firewall unload
~ # esxcli network firewall load

If it has been disabled, you can enable it with:

~ # esxcli network firewall set --enabled true

You can refresh the firewall’s loaded configuration by running:

~ # esxcli network firewall refresh

You can list the firewall rules by running:

~ # esxcli network firewall ruleset list
Name                Enabled
------------------  -------
sshServer              true
sshClient             false
nfsClient             false
dhcp                   true
dns                    true
snmp                   true

And list the rule settings with:

~ # esxcli network firewall ruleset rule list
Ruleset             Direction  Protocol  Port Type  Port Begin  Port End
------------------  ---------  --------  ---------  ----------  --------
sshServer           Inbound    TCP       Dst                22        22
sshClient           Outbound   TCP       Dst                22        22
nfsClient           Outbound   TCP       Dst                 0     65535
dhcp                Inbound    UDP       Dst                68        68
snmp                Inbound    UDP       Dst               161       161

You can view which IPs are allowed for a given ruleset by running:

~ # esxcli network firewall ruleset allowedip list
Ruleset             Allowed IP Addresses
------------------  --------------------
sshServer           All
sshClient           All
nfsClient           All
dhcp                All
dns                 All
snmp                10.10.10.1
ntpClient           All
CIMHttpServer       All

From the last two commands, we can see that there is an inbound rule for SNMP, using port 161, which will accept traffic from 10.10.10.1.

Testing Connectivity

To test connectivity to ports you have enabled you can use Netcat:

~ # nc -h
usage: nc [-46DdhklnrStUuvzC] [-i interval] [-p source_port]
          [-s source_ip_address] [-T ToS] [-w timeout] [-X proxy_version]
          [-x proxy_address[:port]] [hostname] [port[s]]
        Command Summary:
                -4              Use IPv4
                -6              Use IPv6
                -D              Enable the debug socket option
                -d              Detach from stdin
                -h              This help text
                -i secs         Delay interval for lines sent, ports scanned
                -k              Keep inbound sockets open for multiple connects
                -l              Listen mode, for inbound connects
                -n              Suppress name/port resolutions
                -p port         Specify local port for remote connects
                -r              Randomize remote ports
                -s addr         Local source address
                -T ToS          Set IP Type of Service
                -C              Send CRLF as line-ending
                -t              Answer TELNET negotiation
                -U              Use UNIX domain socket
                -u              UDP mode
                -v              Verbose
                -w secs         Timeout for connects and final net reads
                -X proto        Proxy protocol: "4", "5" (SOCKS) or "connect"
                -x addr[:port]  Specify proxy address and port
                -z              Zero-I/O mode [used for scanning]
        Port numbers can be individual or ranges: lo-hi [inclusive]

To test connectivity to a particular IP/Port you can run:

nc -z 192.168.1.1 80

Or you can test a range of ports with:

nc -w 1 -z 192.168.1.1 80-120

If you want to see what sessions are established you can run:

~ # esxcli network ip connection list
Proto  Recv Q  Send Q  Local Address       Foreign Address     State        World ID  World Name
-----  ------  ------  ------------------  ------------------  -----------  --------  ---------------
tcp         0       0  127.0.0.1:8307      127.0.0.1:51833     ESTABLISHED     13607  hostd-worker
tcp         0       0  127.0.0.1:51833     127.0.0.1:8307      ESTABLISHED     13605  hostd-worker
tcp         0       0  127.0.0.1:443       127.0.0.1:59976     ESTABLISHED      2944  hostd-worker
tcp         0       0  127.0.0.1:59976     127.0.0.1:443       ESTABLISHED     18188  python
tcp         0    1383  127.0.0.1:8307      127.0.0.1:51610     ESTABLISHED     13829  hostd-worker
tcp         0       0  127.0.0.1:51610     127.0.0.1:8307      ESTABLISHED      3188  vpxa-worker
tcp         0       0  127.0.0.1:62935     127.0.0.1:8307      TIME_WAIT           0
tcp         0       0  127.0.0.1:60718     127.0.0.1:443       TIME_WAIT           0
tcp         0       0  127.0.0.1:8307      127.0.0.1:59467     ESTABLISHED      2944  hostd-worker
tcp         0       0  127.0.0.1:59467     127.0.0.1:8307      ESTABLISHED      2944  hostd-worker
tcp         0       0  192.168.88.134:443  192.168.88.1:57758  ESTABLISHED      2991  hostd-worker

Keep up to date with new posts on Buildvirtual.net - Follow us on Twitter:
Be Sociable, Share!

Leave a Comment

*

Previous post:

Next post: