Solved

Can't access ESXi host from inside over OpenVPN on the virtual lan

Posted on 2014-01-03
2
2,513 Views
Last Modified: 2014-01-03
This is a bit of a weird one and will take a bit of explaining so bear with me.

We have a VMWare ESXi host in the office. It runs half a dozen VMs that provide various business services.

The host's network is configured so that there's an internal network that all the VMs share. It is separate from the rest of the office outside of the host.

One of the VMs is a pfSense Router Distro. Basically, this VM provides the router and a NAT gateway that connects the internal virtual network to the outer office network.

The host has two management IP addresses - one for the outer office network, and one for the internal virtual network.

pfSense is running an OpenVPN Server, and staff connect to the internal virtual network from home over the internet using the OpenVPN client.

The staff who use the VPN are often NOT on the outer office network. They're usually at home working remotely.

------

Internal virtual network
         192.168.7.0/24
         pfSense router:   192.168.7.0
         ESXi management IP:    192.168.7.3

Outer office network:
         192.168.0.0/24
         ESXi management IP:    192.168.0.3

OpenVPN network:
         10.0.8.0/24
         OpenVPN gateway:   10.0.8.5

------

Here's the problem:

- When I connect to the network from the Internet via OpenVPN, I cannot ping or communicate with 192.168.7.3.
- I CAN communicate with everything else on the internal virtual network
-  Virtual machines on the internal virtual network CAN communicate with 192.168.7.3


I'm confident that OpenVPN is working properly... the firewall is completely opened up and everything else is accessible. There's nothing to specifically deny this one IP address.

I have also tested that pfSense CAN ping the ESXi host on 192.168.7.3.... when it pings using it's network adapter connected to the internal virtual network.

pfSense CANNOT ping the ESXi host on 192.168.7.3 when it pings from the OpenVPN network adapter. pfSense CAN ping everything else on the 192.168.7.0/24 subnet via the OpenVPN network adapter, though.

---------

So my conclusion from all of this, is that there appears to either be a problem with pfSense, or there's a problem with the network configuration on the ESXi host.

Perhaps the issue is that the ESXi host is rejecting connections that come from a separate subnet (the 10.0.8.0/24 subnet that OpenVPN assigns IPs on)? Is there some kind of firewall in ESXi that I don't know about?


Any help would  be greatly appreciated.
0
Comment
Question by:Frosty555
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 6

Accepted Solution

by:
Jon Snyderman earned 500 total points
ID: 39753948
I know this is going to sound really silly, but have you checked the default gateway of the management network?  It should be the pfSense 192.168.7.x IP, right?  

~Jon
0
 
LVL 31

Author Closing Comment

by:Frosty555
ID: 39753959
*facepalm*

That was it - the default gateway for the management network was set to 192.168.0.1 and it needed to be set to 192.168.7.1 .

Thank you, Jon!
0

Featured Post

Don't Cry: How Liquid Web is Ensuring Security

WannaCry is just the start. Read how Liquid Web is protecting itself and its customers against new threats.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When converting a physical machine to a virtual machine using VMware vCenter Converter Standalone or vCenter Converter Enterprise, if an adapter type is not selected during the initial customization the resulting virtual machine may contain an IDE d…
In this article, I will show you HOW TO: Suppress Configuration Issues and Warnings Alert displayed in Summary status for ESXi 6.5 after enabling SSH or ESXi Shell.
This video shows you how to use a vSphere client to connect to your ESX host as the root user. Demonstrates the basic connection of bypassing certification set up. Demonstrates how to access the traditional view to begin managing your virtual mac…
In this video we outline the Physical Segments view of NetCrunch network monitor. By following this brief how-to video, you will be able to learn how NetCrunch visualizes your network, how granular is the information collected, as well as where to f…

717 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question