Skip to main content
A
Anonymous_User
Contributor
January 27, 2008
Question

VNC to private machine -SSL VPN or PAT?

  • January 27, 2008
  • 5 replies
  • 6941 views
Okay, first item I discovered is that you cannot enable static NAT routing and have that interface also be accessible for Admin purposes. So I' m forced to only do a port forward NAT. Public IP -> specific private IP of machine running VNC server (port 5900) Virtual IP is setup to do port forwarding for port 5900 I' ve tried with the straight VNC client, and it won' t connect I' ve tried setting up the SSL VPN as per the docs (web mode). I can login to the SSL VPN web, I can add the bookmark. I can ping the remote machine. I am presented with a screen that says: VNC Server[:port]: The docs say you put in the private IP of the machine running VNC with a " /" after it. I do. I then assume the username/password is that of the VNC and not the Fortigate? Anyway, no matter what I put in I get a java error: rfb.Exception: No matching security types

    5 replies

    abelio
    SuperUser
    abelio
    SuperUser
    January 27, 2008
    Public IP -> specific private IP of machine running VNC server (port 5900) Virtual IP is setup to do port forwarding for port 5900 I' ve tried with the straight VNC client, and it won' t connect
    Did you defined appropiate external->internal firewall policy to allow such traffic? You can use http://kc.forticare.com/default.asp?id=2945&Lang=1&SID= as guideline
    A
    Anonymous_UserAuthor
    Contributor
    January 27, 2008
    That fixed it. I had put in a firewall policy, but did not realize that you did not have to specify a service type, due to the port forwarding. IF I interpret that correctly, it means that the particular workstation in question is ' protected" in the sense that only TCP port 5900 will go to it, right? Even if there is no firewall policy in place to restrict any other port (it' s set to any any basically).
    abelio
    SuperUser
    abelio
    SuperUser
    January 27, 2008
    I had put in a firewall policy, but did not realize that you did not have to specify a service type, due to the port forwarding.
    Port number is not tied to a service; you could configure a web server listening in a non standard port for iinstance
    IF I interpret that correctly, it means that the particular workstation in question is ' protected" in the sense that only TCP port 5900 will go to it, right? Even if there is no firewall policy in place to restrict any other port (it' s set to any any basically).
    only if you consider that vnc is a secure way to access your internal computer... there' re so many exploits out there for outdated/unpatched vnc servers. explore your VPN options too.
    FortiRack_Eric
    FortiRack_Eric
    New Member
    January 27, 2008
    I consider it bad security practice to punch holes in your firewall by opening ports like VNC / RDP etc. Establish a proper VPN (IPsec / SSL) connection first!
    A
    Anonymous_UserAuthor
    Contributor
    January 28, 2008
    As posted in the original post I' ve tried that: I' ve tried with the straight VNC client, and it won' t connect I' ve tried setting up the SSL VPN as per the docs (web mode). I can login to the SSL VPN web, I can add the bookmark. I can ping the remote machine. I am presented with a screen that says: VNC Server[:port]: The docs say you put in the private IP of the machine running VNC with a " /" after it. I do. I then assume the username/password is that of the VNC and not the Fortigate? Anyway, no matter what I put in I get a java error: rfb.Exception: No matching security types
    rwpatterson
    rwpatterson
    New Member
    January 28, 2008
    If you created a custom policy for that, ensure that the source port range is 1-65535, not 5900-5900. Also if you VNC to a different port outside the firewall, the policy still needs the target port number on the INSIDE. For example, public host:8080, private host:5900 > policy would be: Souce interface: external, Wanx, etc. Source: all Desitnation interface: internal, portx, etc. Destination: VIP rule outside IP:port -> inside IP:5900 Service: The one you created (source 1-65535, dest. 5900-5900) Fill in the rest to suit... As Eric stated above, the proper way to do this would be to complete an SSL VPN or IPSec connection first, then connect to the server/PC. Security by obscurity isn' t all that secure...
    A
    Anonymous_UserAuthor
    Contributor
    January 28, 2008
    Okay, I' m trying to explain as carefully as I can: I setup the SSL-VPN in web mode as per the docs and it won' t work with VNC. It keeps generating a java error that I posted in the first post. I can get VNC to work directly (ie, VNC INTO a machine behind the firewall), but obviously it' s not as secure. I' d LIKE to use the SSL-VPN, but it doesn' t seem to want to work
    rwpatterson
    rwpatterson
    New Member
    January 29, 2008
    Personally, I think the web mode is garbage. I use the SSL VPN in tunnel mode. You connect up, open your favorite VNC viewer, and go directly to your server. Don' t stop at Go, collect $200!
    Terms & ConditionsAccessibility statement