如何修改 ESXi HTTP(s) 默认反向代理端口 80 和 443

如何修改 ESXi HTTP(s) 默认反向代理端口 80 和 443How to Change Default HTTP/HTTPS Reverse Ports (80/443) on ESXi请访问原文链接https://sysin.org/blog/esxi-custom-ports/ 查看最新版。原创作品转载请保留出处。作者主页sysin.org片头 - 宣传标语VMware ESXi - 云计算操作系统承载虚拟机、容器和 AI 工作负载的核心基石修改后的效果图本文介绍了如何将 ESXi Host Client或称 VMware Host Client默认的 HTTP(S) 反向代理端口80 和 443修改为 8080 和 8443此为示例可按需修改为指定端口。适用于目前所有主流的 ESXi 版本。需要注意的是此类修改端口的操作不受 VMware 官方支持请勿在生产环境中使用。CSDN 作者提示之前称为 ESXi Host ClientESXi 9.1 开始改名 VMware Host Client参看VMware Host Client 9.1 - 界面焕新, 体验升级。ESXi 6.x | 7.0登录 ESXi Shell编辑配置文件vi /etc/vmware/rhttpproxy/config.xml找到下面两行!-- HTTP port to be used by the reverse proxy --httpPort80/httpPort!-- HTTPS port to be used by the reverse proxy --httpsPort443/httpsPort将 80 和 443 修改为指定的值并保存例如!-- HTTP port to be used by the reverse proxy --httpPort8080/httpPort!-- HTTPS port to be used by the reverse proxy --httpsPort8443/httpsPort重启服务生效/etc/init.d/rhttpproxy restart还是无法访问cat/etc/vmware/firewall/custom-rhttpproxyEOF ConfigRoot service idrhttpproxy-sysin/id rule id0000 directioninbound/direction protocoltcp/protocol porttypedst/porttype port8443/port /rule rule id0001 directioninbound/direction protocoltcp/protocol porttypedst/porttype port8080/port /rule enabledtrue/enabled requiredfalse/required /service /ConfigRoot EOFlocalcli network firewall refresh如何恢复默认值当然也是编辑上述配置文件。ESXi 8.0ESXi 8.0 的 Security Domain Enforcement policy 有所变更参看Domain enforcement change warnings observed on ESXi Host (87510)。修改方法也有所不同。登录 ESXi Shell1、禁用 rhttpproxyDom 强制策略esxcli system secpolicy domainset-nrhttpproxyDom-ldisabled2、编辑配置文件编辑配置文件/etc/vmware/rhttpproxy/config.xml找到下面两行!-- HTTP port to be used by the reverse proxy --httpPort80/httpPort!-- HTTPS port to be used by the reverse proxy --httpsPort443/httpsPort将 80 和 443 修改为指定的值并保存例如!-- HTTP port to be used by the reverse proxy --httpPort8080/httpPort!-- HTTPS port to be used by the reverse proxy --httpsPort8443/httpsPort3、重启反向代理服务/etc/init.d/rhttpproxy restart可选检查服务运行状态/etc/init.d/rhttpproxy status4、开启自定义端口防火墙规则cat/etc/vmware/firewall/custom-rhttpproxyEOF ConfigRoot service idrhttpproxy-sysin/id rule id0000 directioninbound/direction protocoltcp/protocol porttypedst/porttype port8443/port /rule rule id0001 directioninbound/direction protocoltcp/protocol porttypedst/porttype port8080/port /rule enabledtrue/enabled requiredfalse/required /service /ConfigRoot EOFlocalcli network firewall refresh5、恢复反向代理服务的默认安全强制策略。esxcli system secpolicy domainset-nrhttpproxyDom-lenforcing# 报错IO error: [Errno 111] Connection refused# 应使用 localcli区别在于绕过 hostdlocalcli system secpolicy domainset-nrhttpproxyDom-lenforcingESXi 8.0U1 | U2 | U3ESXi 8.0U1 开始修改方法完全不同了。登录 ESXi Shell1、在当前目录下创建一个 json 配置文件用于指定 HTTP(S) 端口值。catproxy.json__PROXY__{proxy:{http_port:8080,https_port:8443}}__PROXY__或者catproxy.jsonEOF { proxy: { http_port: 8080, https_port: 8443 } } EOF2、执行如下命令配置 rhttpproxy 属性configstorecli config currentset-cesx-gservices-krhttpproxy-infileproxy.json可选检查配置结果configstorecli config current get-cesx-gservices-krhttpproxy3、重启反向代理服务/etc/init.d/rhttpproxy restart可选检查服务运行状态/etc/init.d/rhttpproxy status4、开启防火墙规则cat/etc/vmware/firewall/custom-rhttpproxyEOF ConfigRoot service idrhttpproxy-sysin/id rule id0000 directioninbound/direction protocoltcp/protocol porttypedst/porttype port8443/port /rule rule id0001 directioninbound/direction protocoltcp/protocol porttypedst/porttype port8080/port /rule enabledtrue/enabled requiredfalse/required /service /ConfigRoot EOFlocalcli network firewall refreshESXi 9.0 | 9.1登录 ESXi Shell1、在当前目录下创建一个 json 配置文件用于指定 HTTP(S) 端口值。catproxy.json__PROXY__{proxy:{http_port:8080,https_port:8443}}__PROXY__或者catproxy.jsonEOF { proxy: { http_port: 8080, https_port: 8443 } } EOF2、执行如下命令配置 rhttpproxy 属性configstorecli config currentset-cesx-gservices-krhttpproxy-infileproxy.json可选检查配置结果configstorecli config current get-cesx-gservices-krhttpproxy3、重启反向代理服务/etc/init.d/rhttpproxy restart可选检查服务运行状态/etc/init.d/rhttpproxy status4、开启防火墙规则cat/etc/vmware/firewall/custom-rhttpproxyEOF ConfigRoot service idrhttpproxy-sysin/id rule id0000 directioninbound/direction protocoltcp/protocol porttypedst/porttype port8443/port /rule rule id0001 directioninbound/direction protocoltcp/protocol porttypedst/porttype port8080/port /rule enabledtrue/enabled requiredfalse/required /service /ConfigRoot EOFlocalcli network firewall refresh更多VMware 产品下载汇总