The firewall on ESX, which appears to be Linux IP Tables, can be manually maintained via the esxcfg-firewall command on the service console. From what I can tell, the service definitions that are fed to the command are defined in the file /etc/vmware/firewall/services.xml, at least on our ESX 3.0.2 U1. On our ESX systems that file contains the following rule set definitions:
<id>sshServer</id>
<id>sshClient</id>
<id>ftpServer</id>
<id>ftpClient</id>
<id>nfsClient</id>
<id>smbClient</id>
<id>snmpd</id>
<id>vncServer</id>
<id>nisClient</id>
<id>ntpClient</id>
<id>telnetClient</id>
<id>LicenseClient</id>
<id>CIMHttpServer</id>
<id>CIMHttpsServer</id>
<id>CIMSLP</id>
<id>swISCSIClient</id>
<id>vpxHeartbeats</id>
<id>AAMClient</id>
<id>veritasNetBackup</id>
<id>veritasBackupExec</id>
<id>TSM</id>
<id>commvaultStatic</id>
<id>commvaultDynamic</id>
<id>activeDirectorKerberos</id>
<id>kerberos</id>
<id>legatoNetWorker</id>
<id>rshClient</id>
To enable one of these rule set profiles, run the command esxcfg-firewall –e 'name'. As in, esxcfg-firewall ntpClient
