vmware esxi 6.5 使用命令行修改访问主机限制

之前通过 web 页面配置了仅允许 172.22.110.10 通过 web 页面进行访问，导致我本机无法访问，好在 ssh 可以连接，通过命令修改规则即可。

1. 查看命令帮助信息

[root@NODE12:~] esxcli --help
Usage: esxcli [options] {namespace}+ {cmd} [cmd options]

Options:
  --formatter=FORMATTER
                        Override the formatter to use for a given command. Available formatter: keyvalue, xml, csv
  --debug               Enable debug or internal use options
  --version             Display version information for the script
  -?, --help            Display usage information for the script

Available Namespaces:
  device                Device manager commands
  esxcli                Commands that operate on the esxcli system itself allowing users to get additional information.
  fcoe                  VMware FCOE commands.
  graphics              VMware graphics commands.
  hardware              VMKernel hardware properties and commands for configuring hardware.
  iscsi                 VMware iSCSI commands.
  network               Operations that pertain to the maintenance of networking on an ESX host. This includes a wide variety of commands to manipulate virtual networking components
                        (vswitch, portgroup, etc) as well as local host IP, DNS and general host networking settings.
  nvme                  VMware NVMe driver esxcli extensions
  rdma                  Operations that pertain to remote direct memory access (RDMA) protocol stack on an ESX host.
  sched                 VMKernel system properties and commands for configuring scheduling related functionality.
  software              Manage the ESXi software image and packages
  storage               VMware storage commands.
  system                VMKernel system properties and commands for configuring properties of the kernel core system and related system services.
  vm                    A small number of operations that allow a user to Control Virtual Machine operations.
  vsan                  VMware vSAN commands

2. 查看防火墙状态，发现状态为启用，不建议直接关闭防火墙，容易被攻击

[root@NODE12:~] esxcli network firewall get
   Default Action: DROP
   Enabled: true
   Loaded: true

3. 查看防火墙配置规则 ip 地址，vSphereClient 172.22.110.10 即配置的仅允许该地址通过 web 访问。

[root@NODE12:~] esxcli network firewall ruleset allowedip list
Ruleset                 Allowed IP Addresses
----------------------  --------------------
sshServer               All
sshClient               All
nfsClient               All
nfs41Client             All
dhcp                    All
dns                     All
snmp                    All
ntpClient               All
CIMHttpServer           All
CIMHttpsServer          172.22.110.0/24
CIMSLP                  All
iSCSI                   All
vpxHeartbeats           All
updateManager           All
faultTolerance          All
webAccess               All
vMotion                 All
vSphereClient           172.22.110.10
activeDirectoryAll      All
NFC                     All
HBR                     All
ftpClient               All
httpClient              All
gdbserver               All
DVFilter                All
DHCPv6                  All
DVSSync                 All
syslog                  All
WOL                     All
vSPC                    All
remoteSerialPort        All
rdt                     All
cmmds                   All
rabbitmqproxy           All
ipfam                   All
vvold                   All
iofiltervp              All
esxupdate               All
vit                     All
vsanEncryption          All
pvrdma                  All
vic-engine              All
vsanhealth-unicasttest  All

4. 将本机 ip 地址加入对应的规则集中，-i 为加入指定的 ip 地址，-r 为加入指定的规则集（ruleset）

[root@NODE12:~] esxcli network firewall ruleset allowedip add -i 172.22.110.20 -r vSphereClient

5. 查看规则是否生效，可以看到已经将本机 ip 加入规则集中

[root@NODE12:~] esxcli network firewall ruleset allowedip list
Ruleset                 Allowed IP Addresses
----------------------  -----------------------------
sshServer               All
sshClient               All
nfsClient               All
nfs41Client             All
dhcp                    All
dns                     All
snmp                    All
ntpClient               All
CIMHttpServer           All
CIMHttpsServer          172.22.190.0/24
CIMSLP                  All
iSCSI                   All
vpxHeartbeats           All
updateManager           All
faultTolerance          All
webAccess               All
vMotion                 All
vSphereClient           172.22.110.10, 172.22.110.20
activeDirectoryAll      All
NFC                     All
HBR                     All
ftpClient               All
httpClient              All
gdbserver               All
DVFilter                All
DHCPv6                  All
DVSSync                 All
syslog                  All
WOL                     All
vSPC                    All
remoteSerialPort        All
rdt                     All
cmmds                   All
rabbitmqproxy           All
ipfam                   All
vvold                   All
iofiltervp              All
esxupdate               All
vit                     All
vsanEncryption          All
pvrdma                  All
vic-engine              All
vsanhealth-unicasttest  All

6. 访问 web 端验证，成功
   
   更多命令可以参考 百度知道