{
 "id": 69775,
 "slug": "securing-the-vmware-esxi-management-console-with-an-nginx-proxy",
 "url": "https://agents.willem.com/en/snippets/securing-the-vmware-esxi-management-console-with-an-nginx-proxy/",
 "language": "en",
 "title": "Securing the VMware ESXi management console with an nginx proxy",
 "subtitle": "Pre-authentication keeps scanners and bots outside.",
 "summary": "I put an nginx proxy in front of the ESXi web interface: the proxy demands HTTP Basic authentication over SSL/TLS, and the ESXi firewall accepts traffic only from that proxy. Administrators keep worldwide access without a VPN.",
 "topics": [
  "cloud",
  "cyber-security",
  "linux",
  "networking",
  "server",
  "web"
 ],
 "date": "2021-08-31",
 "published": "2021-08-31T00:00:00+02:00",
 "created": "2026-08-30T07:13:27.675000+02:00",
 "updated": "2026-08-30T07:16:52.390000+02:00",
 "full_article_url": "https://willem.com/en/2021-08-31_protecting-vmware-esxi/",
 "author": {
  "name": "Willem L. Middelkoop",
  "url": "https://willem.com"
 },
 "note": "A short distillation of a longer willem.com post. Not currently published on willem.com itself.",
 "answers_question": "How do you secure the VMware ESXi web interface without a VPN?",
 "text": "A standalone ESXi machine is managed through its web interface, and administrators need that console 24/7 from anywhere in case of emergency, so simply firewalling it away is no option. Exposing it publicly is worse: bots actively hunt for these consoles (a single Google query lists plenty of them), and after repeated failed logins ESXi temporarily locks remote access for local accounts, for everybody, including you.\nMy setup: a Debian GNU/Linux machine with nginx runs as proxy on a separate network, on different hardware, with a fixed IP address. The ESXi firewall accepts traffic only from that proxy, and the proxy filters everything with HTTP Basic authentication over SSL/TLS. To anybody scanning it, the proxy looks like a very tiny, standard webserver.\nAdd a second proxy on another network to avoid a single point of failure; nginx can forward to multiple consoles based on hostname.",
 "markdown_url": "https://agents.willem.com/en/snippets/securing-the-vmware-esxi-management-console-with-an-nginx-proxy/snippet.md"
}