Troubleshooting the ESXi Firewall

by admin

I’ve written previously about working with the ESXi firewall, including changing rules and setting security levels. This post will have a look at troubleshooting the ESXi firewall.

You can use both the vSphere client and esxcli to help you when troubleshooting.

Troubleshooting the ESXi Firewall using the vSphere Client

Using the vSphere client, go to the host’s Configuration tab, then click on Security Profile. Under ‘Firewall’, click properties to view the firewall rules:


Using this console you can enable and disable various services, and change where you want to allow connections to the host from, on a port/service basis:


Troubleshooting the ESXi Firewall with ESXCLI

ESXCLI offers a lot in terms of helping you troubleshoot the firewall. To start with you can view the status of the firewall by running:

~ # esxcli network firewall get
   Default Action: DROP
   Enabled: true
   Loaded: true

You can unload and load the firewall module, though the firewall will need to be disabled first, if you want to unload it:

~ # esxcli network firewall set --enabled false
~ # esxcli network firewall unload
~ # esxcli network firewall load

If it has been disabled, you can enable it with:

~ # esxcli network firewall set --enabled true

You can refresh the firewall’s loaded configuration by running:

~ # esxcli network firewall refresh

You can list the firewall rules by running:

~ # esxcli network firewall ruleset list
Name                Enabled
------------------  -------
sshServer              true
sshClient             false
nfsClient             false
dhcp                   true
dns                    true
snmp                   true

And list the rule settings with:

~ # esxcli network firewall ruleset rule list
Ruleset             Direction  Protocol  Port Type  Port Begin  Port End
------------------  ---------  --------  ---------  ----------  --------
sshServer           Inbound    TCP       Dst                22        22
sshClient           Outbound   TCP       Dst                22        22
nfsClient           Outbound   TCP       Dst                 0     65535
dhcp                Inbound    UDP       Dst                68        68
snmp                Inbound    UDP       Dst               161       161

You can view which IPs are allowed for a given ruleset by running:

~ # esxcli network firewall ruleset allowedip list
Ruleset             Allowed IP Addresses
------------------  --------------------
sshServer           All
sshClient           All
nfsClient           All
dhcp                All
dns                 All
ntpClient           All
CIMHttpServer       All

From the last two commands, we can see that there is an inbound rule for SNMP, using port 161, which will accept traffic from

Testing Connectivity

To test connectivity to ports you have enabled you can use Netcat:

~ # nc -h
usage: nc [-46DdhklnrStUuvzC] [-i interval] [-p source_port]
          [-s source_ip_address] [-T ToS] [-w timeout] [-X proxy_version]
          [-x proxy_address[:port]] [hostname] [port[s]]
        Command Summary:
                -4              Use IPv4
                -6              Use IPv6
                -D              Enable the debug socket option
                -d              Detach from stdin
                -h              This help text
                -i secs         Delay interval for lines sent, ports scanned
                -k              Keep inbound sockets open for multiple connects
                -l              Listen mode, for inbound connects
                -n              Suppress name/port resolutions
                -p port         Specify local port for remote connects
                -r              Randomize remote ports
                -s addr         Local source address
                -T ToS          Set IP Type of Service
                -C              Send CRLF as line-ending
                -t              Answer TELNET negotiation
                -U              Use UNIX domain socket
                -u              UDP mode
                -v              Verbose
                -w secs         Timeout for connects and final net reads
                -X proto        Proxy protocol: "4", "5" (SOCKS) or "connect"
                -x addr[:port]  Specify proxy address and port
                -z              Zero-I/O mode [used for scanning]
        Port numbers can be individual or ranges: lo-hi [inclusive]

To test connectivity to a particular IP/Port you can run:

nc -z 80

Or you can test a range of ports with:

nc -w 1 -z 80-120

If you want to see what sessions are established you can run:

~ # esxcli network ip connection list
Proto  Recv Q  Send Q  Local Address       Foreign Address     State        World ID  World Name
-----  ------  ------  ------------------  ------------------  -----------  --------  ---------------
tcp         0       0     ESTABLISHED     13607  hostd-worker
tcp         0       0      ESTABLISHED     13605  hostd-worker
tcp         0       0     ESTABLISHED      2944  hostd-worker
tcp         0       0       ESTABLISHED     18188  python
tcp         0    1383     ESTABLISHED     13829  hostd-worker
tcp         0       0      ESTABLISHED      3188  vpxa-worker
tcp         0       0      TIME_WAIT           0
tcp         0       0       TIME_WAIT           0
tcp         0       0     ESTABLISHED      2944  hostd-worker
tcp         0       0      ESTABLISHED      2944  hostd-worker
tcp         0       0  ESTABLISHED      2991  hostd-worker

Keep up to date with new posts on - Follow us on Twitter:
Be Sociable, Share!

Leave a Comment


Previous post:

Next post: