How to open port for VNC to server? 2

[protos]

What/how can you open the VNC port on the Pix to allow access into a server, we want to connect securely and i know VNC is not the best at all, but this is a quick fix i guess.


thanks

 

[haknwak]

I'm nost sure I follow protos. For quidck and dirty, temporaty you could to

"access-list number allow ip any host ipaddress[/]

which will open that box up to all traffic.

The VNc port number is determined by the type of service running, the OS and lots of other variables.

 

[protos]

yeah, i dont want to open up the box to all traffic, only certain IP from the outside so I can atleast get in and
check some servers, how can i do that ??

thanks man

 

[yizhar]

HI.

VNC listens on TCP port 5900.

If you have remote access VPN configuration in place, you can VNC over the VPN tunnel, so you do not need to open additional ports.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[protos]

no VPN, thats the next step but need to open 1 port only so i can get in and out.

 

[havanajoe]

If you only want the one port open to a certain box for VNC access, and you stated that you know the outside IP address then you would have an access-list that looks something like this...

access-list inbound permit tcp host <outside host> host <inside host> eq 5900
access-group inbound in interface outside


This will allow the outside host to the inside host on port 5900 and then applies the ACL to the interface.

Don't forget you will also have to have a static routable address for your internal box.

static (inside,outside) <registered ip> <inside ip> <mask>

I hope this helps

Dave

 

[jtrovato]

protos what is the inside address of the server?

 

[jtrovato]

static (inside,outside) tcp <outside IP> 5900 <inside server address> 5900 netmask 255.255.255.255 0 0

This will forward all request to port 5900 to inside IP address 192.168.0.10:
static (inside,outside) tcp 206.118.72.54 5900 192.168.0.10 5900 netmask 255.255.255.0 0 0

Llets say you have 2 servers you want to admin, you can use a different port using PAT. This will come into the system using port 5901 and translate it to 5900:
static (inside,outside) tcp 206.118.72.54 5901 192.168.0.10 5900 netmask 255.255.255.0 0 0


you must also use an ACL:
access-list fromoutside permit tcp any any eq 5901
access-list fromoutside permit tcp any any eq 5900
access-group fromoutside in interface outside

this should do it. if you have more questions let me know

John