The service console in ESX 3.x has a firewall enabled by default. The network packet filtering found in Red Hat Linux is called iptables. As the management of iptables is not entirely straightforward, the esxcfg-firewall command makes things a load easier. The firewall rules are stored in /etc/vmware/esx.conf, but we don’t go editing this file, we use this command to ensure it is locked while we make our edits. If you are very interested in the iptables commands used behind the scenes, then you can inspect the log file /var/log/vmware/esxcfg-firewall.logWe use the esxcfg-firewall command to view and configure the firewall rules. The most popular switch will be the -q switch to query the firewall for its current settings.[root@esxhost1 root]# esxcfg-firewall -q<output>

The -s switch will allow you to enable or disable network services that may traverse the firewall successfully. The list of known services are shown below – very case sensitive!….

nfsClient

ftpServer

ntpClient

dellom

nisClient

vncServer

tmpLicenseClient

swISCSIClient

CIMHttpsServer

sshClient

snmpd

tmpAAMClient

vpxHeartbeats

smbClient

hpim

tmpHostVmdbServer

tmpHostdSOAPServer

ftpClient

sshServer

ibmdirector

CIMHttpServer

telnetClient

The -l switch loads the firewall and enables the IP tables.

The -u switch unloads the firewall and disables the IP tables.

We use the -e switch to enable a particular known service, so if we wanted to enable ssh outbound connections from the service console we would simply enter

[root@esxhost1 root]# esxcfg-firewall -e sshClient

We use the -d switch to disable a service. In the following example, we prevent outbound connections

[root@esxhost1 root]# esxcfg-firewall -d smbClient

If we need to open a TCP or UDP port that is not described by a defined friendly name like “sshClient”, then we can explicitly open that port with the -o switch. The service console firewall is bidirectional and so when opening a port you must also specify direction of incoming or outgoing. Equally, we can close an explicit port with the -c switch.

[root@esxhost1 root]# esxcfg-firewall -o port,protocol,direction,name

In the following example, we are opening a unique port which we are calling “customapp”

[root@esxhost1 root]# esxcfg-firewall -o 12345,tcp,out,custom-app

The service names such as sshClient and smbClient are defined in the file /etc/vmware/firewall/services.xml .