Allowing VNC through the PIX

[zephyran]

We want to allow a user to connect from outside, through the firewall, to an internal machine using VNC. I know that I have to allow port 5900 for inbound, but how do I configure this on the PIX?

BTW, we are running a PIX Classic with version 4.0.6 software (yeah, I know it's old, but it can't be helped).

 

[yizhar]

HI.

Follow the pix manual, like with any other service.

You'll need both a STATIC mapping for the internal host to an available registered "global" ip address, and a CONDUIT command.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[zephyran]

Thanks, the CONDUIT part was what I wasn't so sure about (a static mapping already exists).

I've set up a global command to allow TCP and UDP ports 5900 (as required by the VNC software), but the user is still unable to connect. Anyone else have experience setting a PIX to pass VNC connections through?

 

[abovebrd]

static (inside,outside) 199.199.199.199 192.168.1.1 netmask 255.255.255.255 0 0
conduit permit icmp any any
conduit permit tcp host 199.199.199.199 eq 5900 any

Should do the trick

You need the static command and the conduit in place in order to pass port 5900 from an outside IP to an inside IP.

-Danny
dan@snoboarder.net

 

[zephyran]

Our PIX is running software 4.0.6, which uses conduit commands in a different format. The conduit commands I've entered are:

conduit 199.199.199.199 5900 tcp 0.0.0.0 0.0.0.0
conduit 199.199.199.199 5900 udp 0.0.0.0 0.0.0.0

The static command already existed:

static 199.199.199.199 10.0.0.12

 

[abovebrd]

So is it working ?

Did you confirm that port 5900 is open on host 10.0.0.12
Can you connect to this port internally on your network.
(Just trying to isolate the problem to the firewall)

I would then ask that you post atleast part of your PIX config in order to further assist you with this problem. Of course change your IP addresses for security reasons. -Danny
dan@snoboarder.net

 

[zephyran]

I have found the problem... The user that was trying to connect from outside has Windows ME on his system, which is notorious for flaky networking. Another outside user with a Win 2000 system connected in just fine.

Thanks for your help everyone!