ESXi Server has a built-in Firewall to protect your ESXi Server.
There are pre-defined services (source and destination TCP/UDP Port) that you can configure via vSphere Client or CLI, such as permitting or restricting SSH from specified IP Address or Network. These pre-defined services should be sufficient for most of environment.
However there may be a case that you wish to create a custom service, for example when you install a third-party plugin and it uses TCP/UDP that is not defined in the pre-defined list.
