VNC to private machine -SSL VPN or PAT?

[#1]

Okay, first item I discovered is that you cannot enable static NAT routing and have that interface also be accessible for Admin purposes. So I' m forced to only do a port forward NAT. Public IP -> specific private IP of machine running VNC server (port 5900) Virtual IP is setup to do port forwarding for port 5900 I' ve tried with the straight VNC client, and it won' t connect I' ve tried setting up the SSL VPN as per the docs (web mode). I can login to the SSL VPN web, I can add the bookmark. I can ping the remote machine. I am presented with a screen that says: VNC Server[:port]: The docs say you put in the private IP of the machine running VNC with a " /" after it. I do. I then assume the username/password is that of the VNC and not the Fortigate? Anyway, no matter what I put in I get a java error: rfb.Exception: No matching security types

[abelio]

Public IP -> specific private IP of machine running VNC server (port 5900) Virtual IP is setup to do port forwarding for port 5900 I' ve tried with the straight VNC client, and it won' t connect

Did you defined appropiate external->internal firewall policy to allow such traffic? You can use http://kc.forticare.com/default.asp?id=2945&Lang=1&SID= as guideline

[#3]

That fixed it. I had put in a firewall policy, but did not realize that you did not have to specify a service type, due to the port forwarding. IF I interpret that correctly, it means that the particular workstation in question is ' protected" in the sense that only TCP port 5900 will go to it, right? Even if there is no firewall policy in place to restrict any other port (it' s set to any any basically).

[abelio]

I had put in a firewall policy, but did not realize that you did not have to specify a service type, due to the port forwarding.

Port number is not tied to a service; you could configure a web server listening in a non standard port for iinstance

IF I interpret that correctly, it means that the particular workstation in question is ' protected" in the sense that only TCP port 5900 will go to it, right? Even if there is no firewall policy in place to restrict any other port (it' s set to any any basically).

only if you consider that vnc is a secure way to access your internal computer... there' re so many exploits out there for outdated/unpatched vnc servers. explore your VPN options too.

[FortiRack_Eric]

I consider it bad security practice to punch holes in your firewall by opening ports like VNC / RDP etc. Establish a proper VPN (IPsec / SSL) connection first!

[#6]

As posted in the original post I' ve tried that: I' ve tried with the straight VNC client, and it won' t connect I' ve tried setting up the SSL VPN as per the docs (web mode). I can login to the SSL VPN web, I can add the bookmark. I can ping the remote machine. I am presented with a screen that says: VNC Server[:port]: The docs say you put in the private IP of the machine running VNC with a " /" after it. I do. I then assume the username/password is that of the VNC and not the Fortigate? Anyway, no matter what I put in I get a java error: rfb.Exception: No matching security types

[rwpatterson]

If you created a custom policy for that, ensure that the source port range is 1-65535, not 5900-5900. Also if you VNC to a different port outside the firewall, the policy still needs the target port number on the INSIDE. For example, public host:8080, private host:5900 > policy would be: Souce interface: external, Wanx, etc. Source: all Desitnation interface: internal, portx, etc. Destination: VIP rule outside IP:port -> inside IP:5900 Service: The one you created (source 1-65535, dest. 5900-5900) Fill in the rest to suit... As Eric stated above, the proper way to do this would be to complete an SSL VPN or IPSec connection first, then connect to the server/PC. Security by obscurity isn' t all that secure...

[#8]

Okay, I' m trying to explain as carefully as I can: I setup the SSL-VPN in web mode as per the docs and it won' t work with VNC. It keeps generating a java error that I posted in the first post. I can get VNC to work directly (ie, VNC INTO a machine behind the firewall), but obviously it' s not as secure. I' d LIKE to use the SSL-VPN, but it doesn' t seem to want to work

[rwpatterson]

Personally, I think the web mode is garbage. I use the SSL VPN in tunnel mode. You connect up, open your favorite VNC viewer, and go directly to your server. Don' t stop at Go, collect $200!