VNC Through Fortigate

[#1]

VNC uses TCP ports 5900 and 5800 by default. With that in mind, I have VNC successfully working with the following rules. Wireless to Internal Client Internal Client to Wireless Ports 1-65535 Source and 5900 Destination Ports 1-65535 Source and 5800 Destination While I do not like having these ports open at all it is a requirement for our developers. Does anybody have any other rule sets that work which may be a bit more locked down?

[doshbass]

This seems pretty well locked down to me, you are opening 2 ports only

[rwpatterson]

If you combine that with an SSL VPN login, you' re better secured. Create NAT IP ranges for the logins, then create a policy from the external ports using that IP range to the VIP on the same port. Then the only way into those servers would be after a successful login. I did it, so I know it works.

[Hracio]

Use 1024-65535 range as source ports, dest 5800-5900, combined with ssl-vpn as rwpatterson says.. Regards, .!