Knowledge Base

The VMware Knowledge Base provides support solutions, error messages and troubleshooting guides

Search the VMware Knowledge Base (KB)

View by Article ID

About the ESXi 5.0 firewall

This article provides information about the ESXi 5.0 firewall, which provides a new access control capability for ESXi.

These are important points about the ESXi 5.0 firewall:

ESXi 5.0 has a new firewall engine that is not based on iptables.
The firewall is enabled by default and allows Internet Control Message Protocol (ICMP) pings and communication with DHCP and DNS (UDP only) clients.
The UI for configuring the firewall on ESXi 5.0 is similar to that used to configure the ESX firewall.
The firewall is service oriented.
You have the ability to restrict access to specific services based on IP address/Subnet Mask.
There is Host Profile support for the ESXi 5.0 firewall.
If you upgrade from ESX to ESXi 5.0, firewall settings are preserved.

A new esxcli interface (esxcfg-firewall) is available in ESXi 5.0. This table summarizes the commands:

Command	Description
esxcli network firewall get	Returns the enabled or disabled status of the firewall and lists default actions.
esxcli network firewall set --defaultaction	Update default actions.
esxcli network firewall set --enabled	Set to true to enable the firewall, set to false to disable the firewall.
esxcli network firewall load	Load the firewall module and rule set configuration files.
esxcli network firewall refresh	Refresh the firewall configuration by reading the rule set files if the firewall module is loaded.
esxcli network firewall unload	Destroy filters and unload the firewall module.
esxcli network firewall ruleset list	List rule sets information.
esxcli network firewall ruleset set --allowedall	Set the allowedall flag.
esxcli network firewall ruleset set --enabled	Enable or disable the specified rule set.
esxcli network firewall ruleset allowedip list	List the allowed IP addresses of the specified rule set.
esxcli network firewall ruleset allowedip add	Allow access to the rule set from the specified IP address or range of IP addresses.
esxcli network firewall ruleset allowedip remove	Remove access to the rule set from the specified IP address or range of IP addresses.

For more information about the ESXi 5.0 firewall, see the vSphere Security Guide.

To request a new product feature or to provide feedback on a VMware product, please visit the Request a Product Feature page.

1 2 3 4 5

1 2 3 4 5

Actions

Did this article help you?
This article resolved my issue. This article did not resolve my issue. This article helped but additional information was required to resolve my issue.
What can we do to improve this information? (4000 or fewer characters)