VMware ESXi and vSphere Cluster Management

Configure the ESXi Firewall in vSphere

Learn how to view, enable, disable, and restrict ESXi firewall rulesets in vSphere, including source IP controls, host services, lockdown mode, and safe verification.

What the ESXi Firewall Does

The ESXi firewall is a host-level firewall that filters network traffic addressed to ESXi management interfaces and service endpoints. It helps protect services such as remote administration, storage access, name resolution, and migration traffic.

ESXi uses a default-deny model for inbound service traffic: a connection is blocked unless an applicable firewall ruleset is enabled. ESXi enables rules required by active or standard host services, while unrelated inbound traffic remains blocked.

Firewall Rulesets and Service Traffic

An ESXi firewall ruleset is a predefined grouping of protocol and port rules associated with a service or traffic type. Enabling a ruleset permits its associated traffic; disabling it blocks traffic governed by that ruleset.

Rulesets commonly support management, storage, and migration functions. Examples include SSH, ESXi Shell, DNS, DHCP, NFS, iSCSI, vMotion, and general management access. The exact names and available rulesets depend on the ESXi version and installed or active services.

Enable only the rulesets that the host actually requires. A ruleset can be technically valid but still unnecessary in a particular environment. Unneeded access increases the number of services that an attacker or misconfigured system could reach.

Common ESXi Firewall Ruleset Categories

Service or traffic type	Typical purpose	Typical authorized sources	Risk if unnecessarily enabled
SSH	Remote command-line administration	Administration jump host or approved management subnet	Direct attack attempts and unauthorized host changes
ESXi Shell	Local or controlled shell-based troubleshooting	Usually local console or approved administrative path	Increased exposure of a powerful troubleshooting interface
DNS	Name resolution for host and management operations	Designated DNS servers	Unnecessary access from arbitrary networks
DHCP	Address assignment where the host network is designed to use DHCP	Approved DHCP servers or network segment	Unexpected address or configuration changes
NFS	NFS datastore communication	NFS servers or storage subnet	Unwanted storage protocol access
iSCSI	IP-based shared storage access	Authorized iSCSI targets and storage network	Exposure of storage paths and discovery traffic
vMotion	Migration of running virtual machines between hosts	Participating ESXi hosts or vMotion network	Unnecessary access to migration traffic
Management access	Communication needed for host management and orchestration	vCenter Server, management hosts, and approved administrators	Broader exposure of the hypervisor management plane

For storage configuration context, review Configure an NFS datastore and configure iSCSI CHAP. Firewall access alone does not guarantee that storage authentication, exports, VMkernel adapters, VLANs, or routing are correct.

Prerequisites

Know which ESXi host and services you are changing.
Understand the host management network and the relevant VMkernel adapters.
Know basic TCP and UDP firewall behavior.
Understand IPv4 subnets and CIDR notation. For example, 192.0.2.25/32 identifies one host, while 192.0.2.0/24 identifies a network range.
Have the required vSphere permissions and an approved change or maintenance plan.
Keep console access, out-of-band management, or an alternate administrative session available.

Find Firewall Settings in the vSphere Client

Open the vSphere Client and select the target ESXi host in the inventory.
Open the host's management, configuration, or Manage area.
Locate Security Profile. This area groups firewall settings, host services, and related security configuration.
Open the firewall settings or firewall edit interface.
Review the listed rulesets, their enabled or disabled state, and any allowed-source configuration.

Labels and exact navigation wording can differ between vSphere Client versions. If the interface uses a different tab name, look for the selected host's security or host configuration settings rather than VM-level settings.

Host inventory and management fundamentals are covered in the VMware ESXi online course. Ensure the selected object is an ESXi host, not a cluster, datastore, or virtual machine.

Enable or Disable a Firewall Ruleset

In the firewall editor, identify the service or traffic type that must change.
Select or enable the ruleset to allow its associated traffic.
Clear or disable the ruleset to stop allowing that traffic.
Configure allowed source addresses if the interface provides that option.
Save or apply the change.
Refresh the view and confirm the resulting state.
Test the service from an authorized source and, where appropriate, verify that an unauthorized source remains blocked.

For example, disabling SSH filtering can prevent remote SSH connections even when the SSH service is running. Conversely, enabling an SSH ruleset does not start the SSH service by itself; the service must also be available and permitted by host access policy.

Restrict Rulesets by Source IP Address

Allowed IP addresses are source-address restrictions applied to a ruleset. An unrestricted rule permits connections from any reachable source that can pass other network controls. A restricted rule permits connections only from listed IP addresses or CIDR network ranges.

When supported by the ruleset editor, enter only the hosts and networks that need the service. Examples include:

192.0.2.25/32 for one administration jump host.
192.0.2.0/24 for an approved management subnet.
198.51.100.0/24 for a designated storage network.

Plan source restrictions around the actual network path. Include vCenter Server and approved management systems for management traffic, jump hosts for SSH, backup systems for backup-related access, DNS or DHCP servers for those services, storage systems for NFS or iSCSI, and participating hosts or the designated migration network for vMotion.

Example: Restrict SSH to a Jump Host

Enable the SSH-related ruleset only for approved maintenance.
Set its allowed source to 192.0.2.25/32.
Confirm that the SSH service is running and that the jump host can connect.
Verify that an unlisted workstation cannot connect.
Stop or disable SSH and remove the temporary access when maintenance ends.

Example: Allow NFS from a Storage Network

Identify the NFS server or storage subnet, such as 198.51.100.0/24.
Enable the NFS ruleset required by the host's datastore configuration.
Restrict sources to the NFS server or approved storage network where appropriate.
Verify datastore accessibility without enabling unrelated management rulesets.

Example: Prepare vMotion Access

Confirm that participating hosts use correctly configured VMkernel adapters for vMotion.
Ensure the applicable vMotion traffic is allowed.
If source restrictions are used, include the participating hosts or the vMotion subnet.
Perform a controlled migration and confirm that it completes successfully.

Security Profile and Host Services

Security Profile is the host configuration area used to manage firewall rules, host services, and related security settings. A host service is the process or feature that provides a function; a firewall ruleset controls which network traffic may reach that function.

Starting or using a service may require its firewall ruleset to be enabled. Both controls must be checked: a running service with a blocked ruleset is unreachable through that path, while an enabled ruleset with a stopped service does not provide a working service.

Review SSH and ESXi Shell services regularly.
Use them only for approved administration or troubleshooting.
Prefer manual or policy-controlled startup appropriate to the environment rather than leaving temporary services continuously available.
Disable or stop troubleshooting services when the task is complete.
Apply least privilege: allow the minimum service, source range, and duration required.

Startup behavior can vary by service and ESXi version. A manual policy generally requires an administrator to start the service, while a policy-driven startup can start it according to host boot or service dependencies. Verify the displayed startup policy before relying on it.

For permission and administrative access planning, see Assign permissions and the ESXi access control system.

Lockdown Mode and Firewall Administration

Lockdown mode is an ESXi host access-control feature that restricts direct administrative access and encourages management through vCenter Server. It is separate from firewall filtering:

The firewall decides whether network traffic to a service is allowed.
The host service state decides whether a service is available.
Allowed source addresses limit where an enabled service accepts connections.
Lockdown mode limits which administrative access paths and identities can manage the host.

Before enabling stronger lockdown controls, plan exception users and recovery access. Lockdown policies can affect SSH, ESXi Shell, direct console administration, and emergency access. A firewall change that appears correct may still fail if the intended administrator is not permitted by the host's lockdown policy.

Test firewall changes using the host's intended management model. If hosts are normally administered through vCenter Server, validate that path rather than assuming direct ESXi access will remain available. Review communication between vCenter Server and ESXi when planning management dependencies.

Safe Firewall Change Procedure

Assess dependencies. List applications, systems, source networks, ports, and paths that require access.
Record the current state. Capture enabled rulesets, allowed sources, service state, startup policy, and lockdown status.
Prepare recovery. Confirm console, out-of-band management, or an approved alternate administrator session.
Make one controlled change. Change one ruleset, source restriction, or service setting at a time.
Apply and confirm. Save the configuration, refresh the view, and verify the displayed state.
Test authorized access. Test from the intended jump host, vCenter Server, storage system, backup system, or migration network.
Test denial. Where safe, confirm an unlisted source cannot use the restricted service.
Clean up. Remove temporary source entries, disable temporary rulesets, and stop temporary services.
Document the result. Record the final configuration, test evidence, and rollback instructions.

Firewall Change Planning Checklist

Change item	Questions to answer	Validation method	Rollback or recovery consideration
Ruleset enablement	Which service needs access, and who depends on it?	Check state and test the service	Re-enable the prior state or use console access
Source IP restriction	What address does ESXi actually see? Are all required systems included?	Test approved and unlisted sources	Restore the recorded list through an alternate path
Service startup state	Should the service be manual, policy-driven, running, or stopped?	Review service state and perform a controlled restart test if appropriate	Use console or approved vCenter access to restore service
Lockdown mode impact	Will direct access, SSH, ESXi Shell, or exceptions change?	Validate the intended vCenter and emergency access paths	Use planned exception or recovery access
Post-change connectivity test	What must work, and what must remain blocked?	Test from authorized and unauthorized network locations	Follow the documented rollback procedure

Firewall, Host Services, and Lockdown Mode Compared

Control	What it governs	Example use	Primary risk if misconfigured
Firewall ruleset	Whether defined service traffic can reach the host	Allow NFS or vMotion traffic	Required traffic is blocked or unnecessary traffic is exposed
Host service state	Whether a service is running and available	Start SSH for approved maintenance	A powerful service remains available unnecessarily
Allowed source addresses	Which source hosts or networks may use a ruleset	Limit SSH to a jump host	Administrators are locked out or unauthorized sources are allowed
Lockdown mode	Which direct administrative access paths and identities may manage the host	Require centralized vCenter administration	Expected administration or recovery access is unavailable

Troubleshooting

Remote SSH Access Fails After Enabling SSH

Check that the SSH service itself is running.
Check that the SSH firewall ruleset is enabled.
Review the allowed-source list and CIDR boundaries.
Test from the authorized jump host, not only from a workstation.
Check upstream firewalls, routing, VLANs, and NAT or VPN behavior.
Check whether lockdown mode or another host access policy prevents direct access.
If remote access is lost, use console or out-of-band management.

An NFS Datastore Cannot Be Mounted or Accessed

Confirm that the applicable NFS ruleset is enabled.
Confirm that the NFS server or storage subnet is allowed as a source.
Validate the VMkernel network, VLAN, routing, and upstream firewall path.
Check NFS export permissions separately from the ESXi firewall.
Confirm that the datastore configuration and NFS server settings match.

vMotion Fails Between Hosts

Validate vMotion VMkernel configuration on both hosts.
Review the applicable firewall ruleset and source restrictions.
Confirm that participating hosts are included in the permitted migration network.
Check VLAN, routing, and MTU consistency where applicable.
Retry with a controlled test migration.

Host Access Is Lost After Changing Allowed IP Addresses

The active administrator address may have been omitted.
The subnet prefix may be incorrect.
The host may see a VPN, NAT, or jump-host address instead of the workstation address.
Use direct console or out-of-band management to restore the previous source list.
Determine the actual source address seen by ESXi before applying the restriction again.

Exam-Relevant Notes

The ESXi firewall is host-level filtering for management and service endpoints; it is not a guest operating system firewall.
Rulesets group the ports and protocols required by a service or traffic type.
Enabling a ruleset does not necessarily start the associated host service.
Allowed IP addresses restrict the source of connections; CIDR notation defines a host or network range.
Least privilege means enabling only required rulesets and limiting them to required sources.
Lockdown mode is an access-control feature separate from firewall filtering.
Always preserve a recovery path before changing management rules, source restrictions, service state, or lockdown settings.