Configure Firewall

Last update: November 03 2026Open in Markdown

To filter traffic, you can use:

• Edge Gateway Firewall — can be configured on an Edge router in any cluster. Filters traffic between Edge router networks and public networks (North-South), as well as traffic that passes through L3VPN. In clusters with the old network infrastructure type (NSX-V), it also filters East-West traffic;
• Distributed Firewall (DFW) — can be configured only in clusters with the new network infrastructure type (NSX-T). Filters traffic between Edge router networks and public networks (North-South), as well as East-West traffic.

For any Firewall rules, you can create IP Sets — groups of IP addresses.

Edge Gateway Firewall

Edge Gateway Firewall rules are configured on an Edge router. Traffic between Edge router networks and public networks (North-South), as well as traffic that passes through L3VPN, is always filtered. You need to configure Edge Gateway Firewall if you configure Internet access:

• via an Edge router and a private subnet;
• via an Edge router and a public subnet, if the virtual data center is located in a cluster with the new network infrastructure type (NSX-T).

Traffic filtering between networks connected to an Edge router (East-West traffic) depends on the network infrastructure type of the cluster where the virtual data center is located:

• old type (NSX-V) — East-West traffic is filtered;
• new type (NSX-T) — East-West traffic is not filtered. To filter this traffic, configure Distributed Firewall.

In clusters with the new network infrastructure type (NSX-T), Edge Gateway Firewall is always enabled. The default rule default_rule blocks all traffic until you configure Edge Gateway Firewall with other rules.

In NSX-V clusters, a similar rule default rule for ingress traffic blocks all traffic if Edge Gateway Firewall is enabled and no other rules are configured. In such clusters, Edge Gateway Firewall can be disabled.

Configure Edge Gateway Firewall

1. Create an IP Set.
2. Add an Edge Gateway Firewall rule.

Add an Edge Gateway Firewall rule

You can use example rules for Internet access and access from the Internet.

The method of creating a Firewall rule depends on the network infrastructure type of the cluster where the virtual data center is located — old (NSX-V) or new (NSX-T).

NSX-V

1. From the control panel, open the Cloud Director panel: in the top menu, click Products → Cloud Powered by VMware → Cloud Director.

2. Open the virtual data center page.

3. Go to Networking → Edges.

4. Open the desired Edge page.

5. Click Services.

6. Open the Firewall tab.

7. To enable the rule immediately after creation, turn on the Enabled toggle.

8. Click .

9. In the Name field, enter the rule name.

10. In the Source field, configure source addresses:

    10.1. Click .

    10.2. If you want to select all available source addresses, leave the value Any.

    10.3. If you want to select source addresses from an IP Set or other object types, click , in the Browse objects of type field, select the object type, select the objects, and click → KEEP. Available object types:

    • Gateway interfaces — all internal networks (Internal), all external networks (External), or all external and internal networks (Any);
    • Virtual machines — virtual machines;
    • OrgVdcNetworks — organization-level networks;
    • IP Sets — IP address groups;
    • Security Groups — security groups.

    10.4. If you want to select specific source IP addresses, click IP, enter the IP address, and click KEEP.

11. In the Service field, configure the connection:

    11.1. If you want to select all available protocols and ports, leave the value Any.

    11.2. If you want to select specific protocols and ports, click , configure the protocol and ports, and click KEEP.

12. In the Action field, select the action to be performed in the rule:

    • Accept — traffic will be allowed;
    • Deny — traffic will be denied.

13. In the Destination field, configure destination addresses:

    13.1. Click .

    13.2. If you want to select all available destination addresses, leave the value Any.

    13.3. If you want to select destination addresses from an IP Set or other object types, click , in the Browse objects of type field, select the object type, select the objects, and click → KEEP. Available object types:

    • Gateway interfaces — all internal networks (Internal), all external networks (External), or all external and internal networks (Any);
    • Virtual machines — virtual machines;
    • OrgVdcNetworks — organization-level networks;
    • IP Sets — IP address groups;
    • Security Groups — security groups.

    13.4. If you want to select specific source IP addresses, click IP, enter the IP address, and click KEEP.

14. Click Save changes.

NSX-T

1. From the control panel, open the Cloud Director panel: in the top menu, click Products → Cloud Powered by VMware → Cloud Director.

2. Open the virtual data center page.

3. Go to Networking → Edges.

4. Open the desired Edge page.

5. Go to Services → Firewall.

6. Click NEW.

7. In the Name field, enter the rule name.

8. To enable the rule immediately after creation, turn on the State toggle.

9. In the Application field, configure the connection:

   9.1. Click .

   9.2. On the Applications tab, turn on the Choose a specific application toggle.

   9.3. Select the line with the required connection protocol and port.

   9.4. Click SAVE.

10. In the Source field, configure source addresses:

    10.1. Click .

    10.2. If you want to select all available source addresses, turn on the Any Source toggle.

    10.3. If you want to select source addresses from an IP Set, on the Firewall Groups tab, select the IP Set you created in step 1.

    10.4. If you want to select specific source IP addresses, on the Firewall IP Addresses tab, click ADD and enter the IP addresses.

    10.5. Click KEEP.

11. In the Destination field, configure destination addresses:

    11.1. Click .

    11.2. If you want to select all available destination addresses, turn on the Any Destination toggle.

    11.3. If you want to select destination addresses from an IP Set, on the Firewall Groups tab, select the IP Set you created in step 1.

    11.4. If you want to select specific destination IP addresses, on the Firewall IP Addresses tab, click ADD and enter the IP addresses.

    11.5. Click KEEP.

12. In the Action field, select the action to be performed in the rule:

    • Allow — traffic will be allowed;
    • Drop — traffic will be denied, clients will not be sent block notifications;
    • Reject — traffic will be denied, clients will be sent block notifications.

13. In the IP Protocol field, select the IP address type to which the rule will apply.

14. Click SAVE.

Disable Edge Gateway Firewall

For your information

You can disable Edge Gateway Firewall only in clusters with the old network infrastructure type (NSX-V).

1. From the control panel, open the Cloud Director panel: in the top menu, click Products → Cloud Powered by VMware → Cloud Director.
2. Open the virtual data center page.
3. Go to Networking → Edges.
4. Open the desired Edge page.
5. Click Services.
6. Open the Firewall tab.
7. Turn off the Enabled toggle.

Example rule for Internet access

Internet access will be allowed over any protocols to the server with the IP address specified in the rule.

The method of creating a Firewall rule depends on the network infrastructure type of the cluster where the virtual data center is located — old (NSX-V) or new (NSX-T).

NSX-V

1. From the control panel, open the Cloud Director panel: in the top menu, click Products → Cloud Powered by VMware → Cloud Director.

2. Open the virtual data center page.

3. Go to Networking → Edges.

4. Open the desired Edge page.

5. Click Services.

6. Open the Firewall tab.

7. To enable the rule immediately after creation, turn on the Enabled toggle.

8. Click .

9. In the Name field, enter the rule name.

10. In the Source field, configure the source address:

    10.1. Click IP.

    10.2. Enter the IP address of the server that will be allowed Internet access.

    10.3. Click KEEP.

11. In the Destination field, leave the value Any.

12. In the Service field, leave the value Any.

13. In the Action field, select Accept.

14. Click Save changes.

NSX-T

1. From the control panel, open the Cloud Director panel: in the top menu, click Products → Cloud Powered by VMware → Cloud Director.

2. Open the virtual data center page.

3. Go to Networking → Edges.

4. Open the desired Edge page.

5. Go to * Services → Firewall.

6. Click NEW.

7. In the Name field, enter the rule name.

8. To enable the rule immediately after creation, turn on the State toggle.

9. Leave the Application field blank.

10. In the Source field, configure the source address:

    10.1. Click .

    10.2. Open the Firewall IP Addresses tab.

    10.3. Click ADD.

    10.4. Enter the IP address of the server that will be allowed Internet access.

    10.5. Click KEEP.

11. Leave the Destination field blank.

12. In the Action field, select Allow.

13. In the IP Protocol field, select the server IP address type.

14. Click SAVE.

Example rule for access from the Internet

Access from the Internet will be allowed over TCP protocol and port 80 via the external IP address.

NSX-V

1. From the control panel, open the Cloud Director panel: in the top menu, click Products → Cloud Powered by VMware → Cloud Director.

2. Open the virtual data center page.

3. Go to Networking → Edges.

4. Open the desired Edge page.

5. Click Services.

6. Open the Firewall tab.

7. To enable the rule immediately after creation, turn on the Enabled toggle.

8. Click .

9. In the Name field, enter the rule name.

10. In the Source field, leave the value Any.

11. In the Destination field, configure the destination address:

    11.1. Click IP.

    11.2. Enter the external IP address through which access from the Internet will be allowed.

    11.3. Click KEEP.

12. In the Service field, configure the protocol and port:

    12.1. Click .

    12.2. In the Protocol field, select TCP.

    12.3. In the Source Port field, enter 80.

    12.4. In the Destination Port field, leave the value any.

    12.5. Click KEEP.

13. In the Action field, select Accept.

14. Click Save changes.

NSX-T

1. From the control panel, open the Cloud Director panel: in the top menu, click Products → Cloud Powered by VMware → Cloud Director.

2. Open the virtual data center page.

3. Go to Networking → Edges.

4. Open the desired Edge page.

5. Go to Services → Firewall.

6. Click NEW.

7. In the Name field, enter the rule name.

8. To enable the rule immediately after creation, turn on the State toggle.

9. In the Application field, configure the protocol and port:

   9.1. Click .

   9.2. Open the Raw Port-Protocols tab.

   9.3. Click ADD.

   9.4. In the Type field, select TCP.

   9.5. In the Source Ports field, enter 80.

   9.6. Leave the Destination Ports field blank.

   9.7. Click SAVE.

10. Leave the Source field blank.

11. In the Destination field, configure the destination address:

    11.1. Click .

    11.2. Open the Firewall IP Addresses tab.

    11.3. Click ADD.

    11.4. Enter the external IP address through which access from the Internet will be allowed.

    11.5. Click KEEP.

12. In the Action field, select Allow.

13. In the IP Protocol field, select the server IP address type.

14. Click SAVE.

Distributed Firewall

For your information

Distributed Firewall can be configured only in clusters with the new network infrastructure type (NSX-T).

Distributed Firewall (DFW) is a distributed firewall configured for a group of virtual data centers. It filters traffic between Edge router networks and public networks (North-South), as well as East-West traffic between virtual machines without using an Edge router.

To get started, configure Distributed Firewall. After configuration, you can add additional rules, disable rules, or disable Distributed Firewall completely.

Configure Distributed Firewall

1. Create a virtual data center group.
2. Enable Distributed Firewall.
3. Create IP Sets.
4. Add Distributed Firewall rules.

Enable Distributed Firewall

When Distributed Firewall is enabled, a default rule is automatically created that allows internal traffic between virtual data centers.

1. Make sure you have created a virtual data center group.
2. From the control panel, open the Cloud Director panel: in the top menu, click Products → Cloud Powered by VMware → Cloud Director.
3. Open the Networking → Data Center Groups tab.
4. Open the virtual data center group page → the General section.
5. In the Distributed Firewall block, click ACTIVATE DISTRIBUTED FIREWALL.
6. Click ACTIVATE DISTRIBUTED FIREWALL.

Add a Distributed Firewall rule

1. From the control panel, open the Cloud Director panel: in the top menu, click Products → Cloud Powered by VMware → Cloud Director.

2. Open the Networking → Data Center Groups tab.

3. Open the virtual data center group page → the DISTRIBUTED FIREWALL section.

4. Click NEW.

5. In the Name field, enter the rule name.

6. To enable the rule immediately after creation, turn on the State toggle.

7. Optional: in the Applications field, configure the destination port of the virtual machine:

   7.1. Click .

   7.2. Turn on the Choose a specific application toggle.

   7.3. Select the required port.

   7.4. Click SAVE.

8. Optional: in the Context field, select a context profile:

   8.1. Click .

   8.2. Turn on the Choose a specific profile toggle.

   8.3. Select the required profile.

   8.4. Click SAVE.

9. In the Source field, configure source addresses:

   9.1. Click .

   9.2. If you want to select all available source addresses, turn on the Any Source toggle.

   9.3. If you want to select source addresses from an IP Set, on the Firewall Groups tab, select the IP Set you created in step 1.

   9.4. If you want to select specific source IP addresses, on the Firewall IP Addresses tab, click ADD and enter the IP addresses.

   9.5. Click KEEP.

10. In the Destination field, configure destination addresses:

    10.1. Click .

    10.2. If you want to select all available destination addresses, turn on the Any Destination toggle.

    10.3. If you want to select destination addresses from an IP Set, on the Firewall Groups tab, select the IP Set you created in step 1.

    10.4. If you want to select specific destination IP addresses, on the Firewall IP Addresses tab, click ADD and enter the IP addresses.

    10.5. Click KEEP.

11. In the Action field, select the action to be performed in the rule:

    • Allow — traffic will be allowed;
    • Drop — traffic will be denied, clients will not be sent block notifications;
    • Reject — traffic will be denied, clients will be sent block notifications.

12. In the IP Protocol field, select the IP address type to which the rule will apply.

13. Optional: to record filtering logs, turn on the Enable logging toggle.

14. Click SAVE.

Disable Distributed Firewall rules

Disabled rules will not be deleted; you can enable them later.

Disable all rules

When all Distributed Firewall rules are disabled, traffic will no longer be filtered.

1. From the control panel, open the Cloud Director panel: in the top menu, click Products → Cloud Powered by VMware → Cloud Director.
2. Open the Networking → Data Center Groups tab.
3. Open the virtual data center group page → the DISTRIBUTED FIREWALL section.
4. In the Default Policy Status field, click DISABLE.

Disable a single rule

You cannot separately disable the rule created by default when Distributed Firewall is enabled. It is disabled only when all rules are disabled.

1. From the control panel, open the Cloud Director panel: in the top menu, click Products → Cloud Powered by VMware → Cloud Director.
2. Open the Networking → Data Center Groups tab.
3. Open the virtual data center group page → the DISTRIBUTED FIREWALL section.
4. Click EDIT RULES.
5. In the rule line, click .
6. In the State column, turn off the toggle.

Disable Distributed Firewall

When Distributed Firewall is disabled, traffic will no longer be filtered and created rules will be permanently deleted.

1. Disable all Distributed Firewall rules.
2. From the control panel, open the Cloud Director panel: in the top menu, click Products → Cloud Powered by VMware → Cloud Director.
3. Open the Networking → Data Center Groups tab.
4. Open the virtual data center group page → the General section.
5. In the Distributed Firewall block, click ACTIVATE DISTRIBUTED FIREWALL.
6. Click DEACTIVATE DISTRIBUTED FIREWALL.

Create an IP Set

An IP Set is a group of IP addresses to which Firewall rules are applied. Grouping IP addresses into an IP Set allows you not to create a separate rule for each IP address. You can create multiple IP Sets and use them in different Firewall rules or in the same rule for sources and destination addresses.

The method of creating an IP Set depends on the network infrastructure type of the cluster where the virtual data center is located — old (NSX-V) or new (NSX-T).

NSX-V

1. From the control panel, open the Cloud Director panel: in the top menu, click Products → Cloud Powered by VMware → Cloud Director.

2. Open the virtual data center page.

3. Go to Networking → Edges.

4. Open the desired Edge page.

5. Click Services.

6. Open the Grouping object → IP Sets tab.

7. Click .

8. Configure the IP Set:

   8.1. In the Name field, enter the group name.

   8.2. In the IP Addresses field, enter IP addresses or their ranges.

   8.3. Click Keep.

NSX-T

1. From the control panel, open the Cloud Director panel: in the top menu, click Products → Cloud Powered by VMware → Cloud Director.

2. Open the virtual data center page.

3. Go to Networking → Edges.

4. Open the desired Edge page.

5. Go to Security → IP Sets.

6. Click NEW.

7. Configure the IP Set:

   7.1. In the Name field, enter the group name.

   7.2. In the IP Addresses field, enter an IP address or a range of IP addresses.

   7.3. Click ADD.

   7.4. Optional: to add another IP address or range, repeat steps 7.2-7.3.

   7.5. Click SAVE.