Accessing VMware ESX(i) through a Firewall

Are you stuck behind a corporate firewall, which doesn't allow you to connect to your VMware ESX(i) host and/or blocks the port necessary to display the console there?

Here's how to get out.

Pre-Requisites

Obviously you need:

• an SSH account outside of your company's network
• the SSH daemon listening on a port you can access through the firewall (in my case, as the company is very restrictive, I had to add Port 80 to /etc/ssh/sshd_config)
• Windows and the VMware Infrastructure Client (which you most probably do have already)
• an SSH-capable machine within the company's network (most probably Windows & Putty will do as well, but I haven't tried that yet). You need to have root access in order to be able to open ports below 1024.

Setting up a SSH tunnel for VI Client 3

Put something like this into your root's .ssh/config file:

Host dmz-host.com
        User your_account_on_the_remote_machine
        # Port 8080    (I need this, because the firewall wouldn't let me connect on port 22/TCP outbound as mentioned earlier)
        GatewayPorts yes
        LocalForward 902 vmware-host.com:902
        LocalForward 443 vmware-host.com:443

Then as root run:

$ ssh dmz-host.com

This will bring you into an SSH session on dmz-host.com (assuming, that this one is beyond your company's firewall). At the same time, it tunnels all the traffic to the crucial VMware ports through that connection according to your ~/.ssh/config.

Just fire up VMware client, and connect to the server, which you initiated the SSH session from, as if it was vmware-host.com!

That's it. You tricked your network admins.

Shortcuts