记录日常工作关于系统运维,虚拟化云计算,数据库,网络安全等各方面问题。
 
0

Creating Custom Firewall Rules in ESXi 5.0
发表者：分类：云计算容器2012-04-24 12:50:22 阅读[3401]

Creating Custom Firewall Rules in ESXi 5.0

Symptoms

There is a defined set of firewall rules for ESXi 5.0 for Incoming and Outgoing connections on either TCP, UDP, or both.
 
You may be required to open the firewall for the defined port on TCP or UDP that is not defined by default in Firewall Properties under Configuration > Security Profile on the vSphere Client.

Purpose

This article provides instructions on creating Custom Firewall Rules in ESXi 5.0 via command line.

Note: Custom firewall rules can be created only for those ports that are defined by default on the Firewall properties under Security Profile on the vSphere Client.

Resolution

By default, there is a set of pre-defined firewall rules that can be enabled/disabled for the ESXi host from the vSphere client.
 
These firewall services can be enabled/disabled for the defined ports (UDP/TCP) from the vSphere client. However, if you need to enable the service on a protocol that is not defined, you must create new firewall rules from the command line.
 
For example, the DNS Client service can be enabled/disabled only on the UDP port 53. To enable DNS for TCP, complete these steps:
 
  1. Open an SSH connection to the host. For more information, see Using ESXi Shell in ESXi 5.0 (2004746).
  2. List the firewall rules with this command:

    # esxcli network firewall ruleset list

    Name Enabled
    -------------------------------
    sshServer true
    sshClient false
    nfsClient true
    dhcp true
    dns true
    snmp true
    ntpClient false
    CIMHttpServer true
    CIMHttpsServer true
    CIMSLP true
    iSCSI true

    Note: On vSphere client, DNS service is open on port 53 for UDP only.

To enable DNS service on port 53 for TCP by completing these steps:
  1. Backup the file /etc/vmware/firewall/service.xml.

    Note: Verify that the service.xml file has enough privileges for the modifications to be saved. Use the chmod command to change the file permissions.

  2. Add this rule to the service.xml file in a plain text editor:

    ---------------------------------
    <service id="0032">
    <id>DNSTCPOut </id>
    <rule id='0000'>
    <direction>outbound</direction>
    <protocol>tcp</protocol>
    <porttype>dst</porttype>
    <port>53</port>
    </rule>
    <enabled>true</enabled>
    <required>false</required>
    </service>
    -------------------------------

  3. Refresh the firewall rules for the changes to take effect with this command:

    # esxcli network firewall refresh

    Note: This setting does not persist after a reboot. To make this setting persist across a reboot, see the Additional Information section of this article.

  4. List the rules again using this command:

    # esxcli network firewall ruleset list

    Name            Enabled
    --------------  -----------------
    sshServer       true
    sshClient       false
    nfsClient       true
    dhcp            true
    dns             true
    snmp            true
    ntpClient       false
    CIMHttpServer   true
    CIMHttpsServer  true
    CIMSLP          true
    iSCSI           true
    DNSTCPOut       true
Note: The new firewall rule DNSTCPOut allows outgoing connections on TCP port 53. New firewall rules and services are also viewable under the Host Configuration section Security Profile using the vSphere Client. 

Additional Information

To make the firewall configuration persist after a reboot:
  1. Copy the newly defined service.xml file onto persistent storage (such as /store/), or onto a VMFS volume (/vmfs/volumes/volume/).

    # cp /etc/vmware/firewall/service.xml location-of-xml

    Note: A VMFS volume can be stored in a single location and copied to multiple hosts.

  2. Add these lines to the/etc/rc.local file on the host:

    cp location-of-xml-file /etc/vmware/firewall
    esxcli network firewall refresh

    Note: Where location-of-xml file is the location to which the file was copied.



转载请标明出处【Creating Custom Firewall Rules in ESXi 5.0】。

《www.micoder.cc》 虚拟化云计算,系统运维,安全技术服务.

Tags： [阅读全文...]
网站已经关闭评论