1

Goal: to connect to the VM GUI using browser of PC 2 and PC 1 Here is the topology:

VM (ESX Server) <--> (eth0)RPI(wlan0) <--> FunBox Router <--> ISP -- PC 2
                                             ^
                                          PC 1

• Here is the snippet from iptables:

pi@readonly:/etc$ sudo iptables -L -n -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DNAT       tcp  --  0.0.0.0/0            192.168.1.21         tcp dpt:170 to:192.168.2.83:22
DNAT       tcp  --  0.0.0.0/0            192.168.1.21         tcp dpt:171 to:192.168.2.83:80
DNAT       tcp  --  0.0.0.0/0            192.168.1.21         tcp dpt:172 to:192.168.2.83:8080
DNAT       tcp  --  0.0.0.0/0            192.168.1.21         tcp dpt:172 to:192.168.2.83:443
DNAT       tcp  --  0.0.0.0/0            192.168.1.21         tcp dpt:172 to:192.168.2.83:903

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  0.0.0.0/0            0.0.0.0/0  

• Snippet of systemctl status:

 State: degraded
     Jobs: 0 queued
   Failed: 1 units
    Since: Thu 1970-01-01 01:00:02 BST; 49 years 1 months ago
   CGroup: /
           ├─user.slice
           │ └─user-1000.slice
           │   ├─user@1000.service
           │   │ └─init.scope
           │   │   ├─701 /lib/systemd/systemd --user
           │   │   └─704 (sd-pam)
           │   └─session-c1.scope
           │     ├─696 sshd: pi [priv]
           │     ├─711 sshd: pi@pts/0
           │     ├─714 -bash
           │     ├─797 systemctl status
           │     └─798 pager
           ├─init.scope
           │ └─1 /sbin/init
           └─system.slice
             ├─systemd-timesyncd.service
             │ └─267 /lib/systemd/systemd-timesyncd
             ├─dbus.service
             │ └─318 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation
             ├─hciuart.service
             │ └─466 /usr/bin/hciattach /dev/serial1 bcm43xx 3000000 flow - b8:27:eb:30:50:9d
             ├─ssh.service
             │ └─616 /usr/sbin/sshd -D
             ├─dnsmasq.service
             │ └─625 /usr/sbin/dnsmasq -x /run/dnsmasq/dnsmasq.pid -u dnsmasq -r /run/dnsmasq/resolv.conf -7 /etc/dnsmasq.d,.dpkg-dist,.dpkg-old,.dpkg-new --local-service
             ├─avahi-daemon.service
             │ ├─353 avahi-daemon: running [readonly.local]
             │ └─371 avahi-daemon: chroot helper
              ├─system-getty.slice
             │ └─getty@tty1.service
             │   └─611 /sbin/agetty --noclear tty1 linux
             ├─triggerhappy.service
             │ └─345 /usr/sbin/thd --triggers /etc/triggerhappy/triggers.d/ --socket /run/thd.socket --user nobody --deviceglob /dev/input/event*
             ├─systemd-logind.service
             │ └─339 /lib/systemd/systemd-logind
             ├─cron.service
             │ └─335 /usr/sbin/cron -f
             ├─systemd-udevd.service
             │ └─127 /lib/systemd/systemd-udevd
             ├─rsyslog.service
             │ └─317 /usr/sbin/rsyslogd -n
             ├─bluetooth.service
             │ └─472 /usr/lib/bluetooth/bluetoothd
             ├─networking.service
             │ ├─441 /sbin/wpa_supplicant -s -B -P /run/wpa_supplicant.wlan0.pid -i wlan0 -D nl80211,wext -C /run/wpa_supplicant
             │ └─535 /sbin/dhclient -4 -v -pf /run/dhclient.wlan0.pid -lf /var/lib/dhcp/dhclient.wlan0.leases -I -df /var/lib/dhcp/dhclient6.wlan0.leases wlan0
             └─systemd-journald.service
               └─91 /lib/systemd/systemd-journald

• Another snippet:

pi@readonly:/etc$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination  

• I am able to reach the ESXi SSH on port 22, from both, PC 1 and PC 2:

[SSH] Server Version OpenSSH_7.7
[SSH] Logged in (keyboard-interactive)

The time and date of this login have been sent to the system logs.

WARNING:
   All commands run on the ESXi shell are logged and may be included in
   support bundles. Do not provide passwords directly on the command line.
   Most tools can prompt for secrets or accept them from standard input.

VMware offers supported, powerful system administration tools.  Please
see www.vmware.com/go/sysadmintools for details.

The ESXi Shell can be disabled by an administrative user. See the
vSphere Security documentation for more information.
[root@vmbox:~] help

• Snippet of ifconfig on RPI:

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.2.1  netmask 255.255.255.0  broadcast 192.168.2.255
        inet6 fe80::ba27:ebff:fe9a:fa37  prefixlen 64  scopeid 0x20<link>
        ether b8:27:eb:9a:fa:37  txqueuelen 1000  (Ethernet)
        RX packets 80  bytes 10371 (10.1 KiB)
        RX errors 0  dropped 10  overruns 0  frame 0
        TX packets 115  bytes 14448 (14.1 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 172  bytes 14220 (13.8 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 172  bytes 14220 (13.8 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.21  netmask 255.255.255.0  broadcast 192.168.1.255
        inet6 fe80::ba27:ebff:fecf:af62  prefixlen 64  scopeid 0x20<link>
        ether b8:27:eb:cf:af:62  txqueuelen 1000  (Ethernet)
        RX packets 998  bytes 66198 (64.6 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 648  bytes 107537 (105.0 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

• Not able to reach the ESXi GUI neither from PC 1, nor PC 2

• ESXi interface is configured with DHCP and on RPI, is set dhcpcd, the IP is assigned, and I able to see: To manage this host go to: http://192.168.2.83/ on the ESXi.

• Able to ping PC 1 and PC 2 from ESXi

Question: How to fix it, in order to be able to reach the GUI of ESXi from the PC 1 and PC 2?

2

You have got a small error in there. In the list of the necessary ports for administering ESXi, it is 902/TCP and not 903/TCP.

You might also need 902/UDP on some situations.

See vmware white paper TCP and UDP Ports for the vSphere Client

  • 443 (Default)

HTTPS access vSphere Client access to vCenter Server vSphere Client access to ESXi hosts vSphere Client access to vSphere Update Manager Incoming TCP to the ESXi host

  • 902 (Default)

vSphere Client access to virtual machine consoles Incoming TCP to the ESXi host, outgoing TCP from the ESXi host, outgoing UDP from the ESXi host

  • But, I don't have any certs installed on ESXi yet, so, I am using HTTP. Would it still needed to forward on 903? – readonly Feb 16 at 6:46
  • HTTP alone clearly was never enough, but it does seem you did not read what I wrote here. – Rui F Ribeiro Feb 16 at 9:08
  • Yes, you're right, I am a little bit new to it..So, I can, add another port forwarding rule, both, on FunBox and RPI, in order to forward to 902/TCP(UDP). But, do you mean, that, as soon as I will put into the browser of PC 2, the external IP of my FunBox followed by colon and port, configured on FunBox to forward to RPI, which configured to forward to HTTP 80 of ESXi, browser will also be able to make another connection to port 902, at the same time?? – readonly Feb 16 at 10:02
  • And also, regarding the white page: "902 (Default) -- vSphere Client access to virtual machine consoles " - isn't it for the console access only, like SSH? – readonly Feb 16 at 10:05
  • 1
    Perfecto! Works like a charm! Thank you so much – readonly Feb 16 at 11:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.