VMWare Workstation Firewall

Posted on 2010-08-25
Last Modified: 2013-11-16
I have installed VMWare Workstation 7 on Windows Server 2008, Bridged Network connection, everything runs fine. Now I have to close all ports but one (svn 3690) on the VMs (Win XP), what I did with some Firewall-tools installed on the VMs directly, but this is quite complex to administer and can be turned off by admin-users on the VM.

Is there a possibility to set up the firewall for the Bridged Network of Workstation directly? I tried to set up the firewall on the host (Windows 2008), but these settings were then not for the VMs as they have an own, fixed IP.

Thank you for helping.
Question by:skiaholic
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 4
LVL 28

Assisted Solution

bgoering earned 500 total points
ID: 33522833
Probably not - the host firewall will not work because the IP address belongs to the virtual machine and the host won't see traffic destined for the vm.

What you can do is install a virtual firewall like monowall ( into your environment and control access to your vm that way. It would look something like:

host -> bridged -> monowall outside -> monowall inside -> guest

monowall outside will be a bridged connection to the host (and own the IP presently held by guest)
monowall inside will be a host only network (addressed on the range for your host ony)
guest will also be on the same host only network (addressed on the range for your host ony, with a gateway to the monowall inside)

The monowall is a very low overhead virtual machine, it has three network interfaces (but you won't need the DMZ network for what you are doing) and only uses about 64 Mbit of RAM

Hope this helps
LVL 28

Expert Comment

ID: 33522855
There are other virtual router firewalls you can also look at such as PFsense or Vyatta, they also have free editions like monowall - I use monowall extensively myself so that one always comes to mind first.

Author Comment

ID: 33533869
Thank you for this tip, I've just installed monowall as a VM in Workstation now, trying to set it up. But something seems wrong I think with my monowall-inside network configuration or the host-only VMnet1.

- WAN set to a fixed IP of my subnet, gateway same as the old VM
- LAN set to fixed IP of my subnet
- Network Adapter 1 to VMnet0 (bridged to uplink)
- Network Adapter 2 to VMnet1 (host-only)

new VM
- Network Adapter set to VMnet1 (host-only)
- a fixed IP of my subnet, gateway the monowall-LAN
- can't ping gateway

no changes on host-network and the old VM is still running bridged fully connected to outside. Any idea what I could have done wrong?
Instantly Create Instructional Tutorials

Contextual Guidance at the moment of need helps your employees adopt to new software or processes instantly. Boost knowledge retention and employee engagement step-by-step with one easy solution.

LVL 28

Assisted Solution

bgoering earned 500 total points
ID: 33534038
In my monowall setup there are three network adapters

Network Adapter 1 should be assigned to host-only (It is LAN on monowall)
Network Adapter 2 should be assigned to bridged (it is WAN on monowall)
Network Adapter 3 Will be unused in your setup, bridge it to NAT if you wish (it is DMZ on monowal)

On monowall WAN looks good - should have old VM address/gateway
On monowall LAN should have IP address on your host-only, can be anything but typically go with subnet assigned by VMware install
On monowall DMZ just leave as DHCP

VM setup looks good
LVL 28

Expert Comment

ID: 33534054
Looks like just switch NA1 to host-only and NA2 to briddged should do it

Author Comment

ID: 33534124
I tried that before, then I can't connect to webGui anymore (from host). switching it back it connects again.
LVL 28

Expert Comment

ID: 33534288
.To connect from the host you will need to make sure your host only networking is what vmware workstation is expecting. In my case (see screen shot) my VMnet1 host only is on

Now if you go into Network properties you will find the Workstation has assigned to the NIC it created for VMnet1 an IP4 address of x.x.x.1 - in my case

You should assign monowall something like x.x.x.5 (.5 is what I use, but anything other than .1 will work) then you will be able to manage it from the host.

Now on your VM setup networking as x.x.x.whatever and make the gateway x.x.x.5

Your WAN address on the monowall will be whatever your vm address was while it was bridged.

Hope this helps

Author Comment

ID: 33683730
Hallo, thank you for support until now, in the last weeks I could not have a look at this topic because of other things. Now I have set up a monowall-VM and a WinXP-VM. I setup the firewall rules and this works all (I can connect from WinXP to outside and bloc ports in monowall).

Now only one problem: I want to connect to the WinXP-VM from outside. From my idea this would work with the IP of monowall-VM (WAN-address), and forward the port to the IP of WinXP-VM (mine, I'm using Radmin right now.

It doesn't work. I can't ping monowall-WAN-IP. Any idea why? Thanks for your help!!
LVL 28

Accepted Solution

bgoering earned 500 total points
ID: 33684696
You are correct - you will need to setup two things on the monowall.

1. An inbound nat rule that will take traffic on a particular port on WAN interface IP and translate it to your XP vm ip address and port on LAN segment

2. A firewall rule under the WAN tab that allows the traffic  to the WinXP vm. I believe if you create this first it will offer to create the NAT rule for you

Good Luck

Author Closing Comment

ID: 33689618
Finally, everything works as the idea was at the beginning. Thanks very much for your help and patience!

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I will show you HOW TO: Perform a Physical to Virtual (P2V) Conversion the easy way from a computer backup (image).
After seeing many questions for JRNL_WRAP_ERROR for replication failure, I thought it would be useful to write this article.
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…

623 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question