This should copy the custom firewall rule from persistent storage to non-persistent storage and allow the firewall rule to apply after host reboots. I had to edit /etc/profile.local on the host to be the following:Ĭp /vmfs/volumes/4f98a505-1c5e5461-1a09-e83935ea53b6/AllowVnc.xml /etc/vmware/firewall This is persistent storage and will not change with a host reboot, but the /etc/vmware/firewall directory will be flushed except for default built-in firewall rules. To make the firewall change persistent (keep it working after host reboots), I used the datastore browser to upload the XML file for the custom firewall rule to the root folder of the datastore (which happens to be /vmfs/volumes/4f98a505-1c5e5461-1a09-e83935ea53b6 from the command line but would be different for you). It will not apply after a host reboot until I login via SSH and run esxcli network firewall refresh. At this point, I could open a VNC connection to the VM, was prompted for the VNC password, and was able to reach the console with no issues.įurther readings told me that this custom firewall rule will not be a permanent change. The rule named AllowVnc appeared in the list with TCP port 5901.

This rule could then be seen from the vSphere client by clicking on the ESXi server and then going to Security Profile. I then had to run the command esxcli network firewall refresh followed by esxcli network firewall ruleset list to verify a firewall rule named AllowVnc was set to true. I then created the file AllowVNC.xml (attached to this ticket) using vi with the following code that allows TCP connections to the host on port 5901: Then, I ran the command cd /etc/vmware/firewall. To do this, I first had to connect to the ESXi server (192.168.0.2) via SSH and login as user root. There's no way to allow VNC connections through the firewall in the vSphere Client, so I had to create a custom firewall rule. But the problem was that the firewall of the ESXi server was blocking inbound VNC connections. To connect to a VM using VNC, you have to connect to ipaddressofhost:vncport (port 1 is the same as 5901 in the VNC world, 2 is 5902, etc.). He following lines were added to the VMX file (using method 1 listed above) for the VM to allow VNC connections on port 5901 and require a VNC password. The VM must be connected to via the console because the USB HASP required to run the software will not allow it to run via remote desktop. Here's an example of what I did to allow VNC connections to a VM running on our ESXi 5.1 host.

Vmware vnc connection