Paul,
Theory:
First of all, it's a *really* bad idea to forward 5900 through your =
modem -- VNC is (a) not a secure transmission, so any motivated cracker =
with a sniffer can watch exactly what you're doing and typing, including =
passwords, and (b) it's designed to be a great remote desktop package =
(which it is), not a secure port to the inside of your machine.
Operation:
That being said, you should definitely consider installing an SSH Server =
on your XP box, and then "allow loopback connections only" to the VNC =
Server. Simply forward port 22 from the firewall/modem to the machine =
and (local) tunnel 5900 when you establish a (SSH) connection to the =
machine.
Tasks:
1. DSL Modem: Turn off the port forward for port 5900
2. DSL Modem: Enable SSH service port forwarding on the modem (this =
forwards port 22)
3. XP Computer: Make note of LAN Connection settings (Start>Run>cmd then =
at the command prompt type "ipconfig /all > ipconfig.txt" Note the =
directory that you're operating in (by reading the prompt) and then exit =
the shell. Find the ipconfig.txt file and print it.
4. XP Computer: Change from DCHP to Static IP. Bring up the Internet =
Protocol properties box by double-clicking the LAN connection icon in =
the system tray, click Properties, then highlight "Internet Protocol =
(TCP/IP)" and click Properties. In the General tab, select the "Use the =
following IP address" radio button and enter the information as you have =
it on your printout. Do the same for the DNS servers. It's important =
to note that you *never* put preceding zeros in an IP address (to be =
clear: 192.168.1.60 will fail if it's entered "192.168.001.060" on most =
machines). This is important so that the modem doesn't lose the XP =
computer. =20
5. XP Computer: Install an SSH Server (available at =
http://sshwindows.sourceforge.net/ (easier) or http://www.cygwin.com/ =
(more secure and up-to-date)). Follow instructions in the "quick start" =
or "readme," paying particular attention to the part where you should =
only add an entry for the accounts you'd like to allow access to =
(otherwise an insecure account could be created as "guest" or =
something).
6. Walk the dog and have a cup of coffee. He needs the break and so do =
you.
7. XP Computer: Install VNC as a System Service, and select "allow =
loopback connections."
8. Computer B on LAN: Assuming a VNC client is installed, point the =
client at the XP server machine, and check to see that it works. If so, =
move on to step 9. If not, we need to figure that out first.
9. XP Computer: In the VNC settings box, check the box for "Allow =
Loopback Connections ONLY"
10. Computer B on LAN: check to see if you can VNC into the computer =
again. It should fail this time with "Connection Refused" or something.
11. Computer B on LAN: Download PuTTY (which is a nice SSH Client) from =
http://the.earth.li/~sgtatham/putty/latest/x86/putty-0.58-installer.exe =
and install it. Open PuTTY and point it at the XP computer. You may =
wish to save a session so that it's simple to set up again. Put the IP =
Address of the XP computer in the appropriate box and select "SSH" =
protocol. In the Category list to the left, go to =
Connection>SSH>Tunnels and add a local port forward by choosing an =
arbitrary source port (5901 to 5962 are unassigned right now, so I use =
one in that range -- let's say we'll use 5959). Put that source port in =
the appropriate box; the destination should be localhost:5900. You may =
also put the name of your XP Computer in there instead of localhost. =
Now click back to Session in the Category list and type a name in the =
"Saved Sessions" box, and then click "Save." Now double-click that new =
entry in the saved sessions list and you should see a new box pop up =
with a warning that the server's key isn't cached. You can be =
reasonably sure (since you're inside your firewall) that this is safe. =
You may wish to make note of the last few characters of the key so that =
you can always be sure that it's your server that you're talking to. =
Every time your server IP Address (or WAN address from outside the =
firewall) changes, it will warn you again. Once you accept the warning =
and choose to continue, a new box will pop up with a connection to the =
XP computer, asking for a username and password. I recommend using a =
non-administrator account to reduce the amount of damage that could be =
done if someone got your credentials, but I question how much privilege =
separation really exists in XP. =20
12. Computer B on LAN: Once you have established a connection via SSH, =
you can minimize that window and bring up a VNC client. Point the VNC =
client at localhost::5959, or whatever port you chose. =20
13. Now, if you know the WAN IP address of your DSL Modem on the =
outside, you should be able to get into your home using the same exact =
method described in task 12.
14. If you're here and everything is working, grab a nice hoppy ale and =
go sit outside with Fido. You've done a good job. The only thing left =
to do is to get your WAN IP address remotely. That's for another post. =
Once you get here, I'll try and put it together. =20
There is more detailed theory in an earlier post, at =
http://sourceforge.net/mailarchive/message.php?msg_id=3D15106344 and =
there is a "VNC over SSH" page with pretty pictures at =
http://www.comp.nus.edu.sg/~andrews/vnc_ssh/
HTH
John Muller
----- Original Message -----=20
From: "Paul Myers" <myersp@...>
To: <vnc-tight-list@...>
Subject: Re: unable to connect verizon dsl
Date: Thu, 27 Apr 2006 00:23:07 -0400
Thanks for the advice, still not working. I am trying to enable port=20
forwarding on the Westell modem
i.e Custom services - Port forwarding 5900
does it sound like I'm on right track, Verizon tech said I just needed =
to=20
get PPP address from modem, but that still isn't working.
I have tested with windows and norton firewall turned off
----- Original Message -----=20
From: <jmuller@...>
To: <vnc-tight-list@...>
Sent: Tuesday, April 25, 2006 9:16 AM
Subject: RE: unable to connect verizon dsl
Paul,
I'm going to assume that you have physical access to the machine that =
you're=20
trying to connect to -- in that case, I would do the following:
1. Get on the LAN of the machine and see if you can connect using =
another=20
computer (if not, check the WinXP firewall settings).
2. Check that the DSL firewall/modem/router is set to forward the =
correct=20
port to the WinXP VNC server.
In order to connect from outside the network (e.g. connect from work to=20
home), you will need to know the IP address of your DSL modem (the WAN =
or=20
PPP address that you mention). One thing to bear in mind is that DSL =
WAN IP=20
addresses are usually pretty dynamic, so if you're writing it down to =
take=20
it to work, it has probably changed before you pet the dog and leave the =
driveway. In order to always know my home IP address, I use a Perl =
script=20
(called via CRON every 15 minutes) that queries the modem and then posts =
the=20
WAN IP Address on a passworded website.
A note on security -- you really should use a Secure Shell system (like=20
OpenSSH) to gain access to your network, and tunnel the VNC traffic =
through=20
that SSH program. If you have a lot of traffic on your home network, =
and=20
the IP address never drops, you stand a higher probability that someone =
will=20
try to crack your network, so it's a good idea to let the address drop =
-- =20
"security through obscurity." I have posted on tunneling VNC through =
SSH in=20
the past and it should be in the archives. Let me know if you can't =
find=20
it -- more prudent security benefits us all.
John Muller
|
