If you connect clients directly to your ESXi network instead of using vCenter Server, your firewall configuration is somewhat simpler.
You might install firewalls at any of the locations shown in Firewall Configuration for ESXi Networks that a Client Manages Directly.
Networks configured without vCenter Server receive communications through the same types of clients as they do if vCenter Server were present: vSphere Clients or third-party network management clients. For the most part, the firewall needs are the same, but there are several key differences.