troubleshooting Question

Can't access ESXi host from inside over OpenVPN on the virtual lan

Avatar of Frosty555
Frosty555Flag for Canada asked on
NetworkingSoftware FirewallsVMware
2 Comments1 Solution3384 ViewsLast Modified:
This is a bit of a weird one and will take a bit of explaining so bear with me.

We have a VMWare ESXi host in the office. It runs half a dozen VMs that provide various business services.

The host's network is configured so that there's an internal network that all the VMs share. It is separate from the rest of the office outside of the host.

One of the VMs is a pfSense Router Distro. Basically, this VM provides the router and a NAT gateway that connects the internal virtual network to the outer office network.

The host has two management IP addresses - one for the outer office network, and one for the internal virtual network.

pfSense is running an OpenVPN Server, and staff connect to the internal virtual network from home over the internet using the OpenVPN client.

The staff who use the VPN are often NOT on the outer office network. They're usually at home working remotely.

------

Internal virtual network
         192.168.7.0/24
         pfSense router:   192.168.7.0
         ESXi management IP:    192.168.7.3

Outer office network:
         192.168.0.0/24
         ESXi management IP:    192.168.0.3

OpenVPN network:
         10.0.8.0/24
         OpenVPN gateway:   10.0.8.5

------

Here's the problem:

- When I connect to the network from the Internet via OpenVPN, I cannot ping or communicate with 192.168.7.3.
- I CAN communicate with everything else on the internal virtual network
-  Virtual machines on the internal virtual network CAN communicate with 192.168.7.3


I'm confident that OpenVPN is working properly... the firewall is completely opened up and everything else is accessible. There's nothing to specifically deny this one IP address.

I have also tested that pfSense CAN ping the ESXi host on 192.168.7.3.... when it pings using it's network adapter connected to the internal virtual network.

pfSense CANNOT ping the ESXi host on 192.168.7.3 when it pings from the OpenVPN network adapter. pfSense CAN ping everything else on the 192.168.7.0/24 subnet via the OpenVPN network adapter, though.

---------

So my conclusion from all of this, is that there appears to either be a problem with pfSense, or there's a problem with the network configuration on the ESXi host.

Perhaps the issue is that the ESXi host is rejecting connections that come from a separate subnet (the 10.0.8.0/24 subnet that OpenVPN assigns IPs on)? Is there some kind of firewall in ESXi that I don't know about?


Any help would  be greatly appreciated.
ASKER CERTIFIED SOLUTION
Jon Snyderman

Our community of experts have been thoroughly vetted for their expertise and industry experience.

Join our community to see this answer!
Unlock 1 Answer and 2 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 2 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros