Firewalling

[mOlive13]

Hi,
Very good script and very good idea ! Thanks for the job.
I tried to use it and and I trouble with ESXi firewall. it can't validate the challenge because of firewall trouble (error 400)
If I well understood, in script renews.sh, row 84 you open the firewall :
esxcli network firewall ruleset set -e true -r httpClient
but if we have a list of allowed ip that in this ruleset (which is my case) that will not open for LE servers IPs.
so, what I propose is to use this :
esxcli network firewall ruleset set -a true -r httpClient
and at the end of the script :
esxcli network firewall ruleset set -a false -r httpClient
I tested it and it works.

[Churro]

Hi, thanks for the suggestion. I noticed that esxcli network firewall ruleset set -a true -r httpClient only changes the allowedip list but doesn't enable the ruleset if disabled. So, enabling would still be needed in addition.

My biggest concern with the proposed change is that esxcli network firewall ruleset set -a false -r httpClient will implicitly disable all allowed IPs, even if this setting was intentionally allowed before w2c-letsencrypt-esxi was even run.

As of now, I can think of two approaches to address this properly:

• When running renew.sh, first read the current enabled/disabled states of the httpClient ruleset and the --allowed-all option, e.g., via esxcli network firewall ruleset list | grep httpClient. Then after the script has run, reset to the states.
• Create a custom firewall rule for w2c-letsencrypt-esxi that allows the same rules as httpClient but for all IPs (esxcli network firewall ruleset rule list -r httpClient). This rule could then be enabled at the start of the script and disabled at the end without conflict.

[mOlive13]

Hi,
Thanks for the answer.
I did some test and when a reactivate all allowed IPs my version of ESXi (7.0.3) keep the list as is.

For the first point, you are right because I run the commande before the renew.sh script.

[nvram93]

hey there did you had the chance to implement one of your proposed fixes yet, so the script finally works fully automated on servers with firewall with allowed ip list?

[Churro]

Sorry, seems I dropped the ball, will put it on my list.