up vote 0 down vote favorite
share [g+] share [fb]

I have set up a VNC server/service on my home PC with TightVNC. I have then set up VNC access on my work Mac, and have downloaded Chicken of the VNC as a client. I have created a dyndns host for my home PC.

What else do I need to do to make this work? I keep googling and end up installing more and more software, to no avail. The documentation on this issue is so scarce I'm surprised anyone but the most hardcore of pros can set this up.

Which ports do I need to open on which ones of my routers? Do I need to set up something special for dyndns? I would like to be able to both SSH and VNC both of my machines from the other.

Are there any solid guides anywhere on mutual PC-Mac remote access?

Edit: info on networks in question

The work environment is a wireless network on a Linksys WRT54GL. The connection is a synchronous DSL connection with a static IP. There are 10ish computers on it, of which 5 of them will need VNC/SSH access from the outside. On the router, static local IPs have been set up.

The home environment is a LAN, on a regular DSL with a dynamic IP. DynDNS has been set up on it, and ports 5900 and 22 opened on TCP for SSH and VNC access, and directed to the local IP of the home PC.

The end goal is each of us being able to connect to our work machines via VNC and SSH, and vice versa. I have succeeded in VNCing home from work. SSH reports "no response", even though the port is opened at home.

Not sure about NAT or routable. Internet is between the networks.

Edit 2:

I imagine I could forward multiple ports, then the SSH setup would be thus: User 1: external port: 22, internal port: 22, local IP: user1's local IP User 2: external port: 23, internal port: 22, local IP: user2's local IP User 3: external port: 24, internal port: 22, local IP: user3's local IP etc... But this feels more like a hack of some sort. Is this the right way to approach it?

link|improve this question
You realize that PCs don't come with an SSH daemon ("server") and that Mac's are disabled by default? – gravyface May 31 '11 at 9:45
I did not realize that, no. That is useful information. I'll google around on how to enable those. – Swader May 31 '11 at 9:52
feedback

migrated from serverfault.com May 31 '11 at 10:08

This question came from our site for system administrators and desktop support professionals.

3 Answers

up vote 3 down vote accepted

In this situation I would recommend just using LogMeIn. It is a simple to use, secure remote desktop solution that works PC-PC, Mac-Mac, PC-Mac, and Mac-PC. It is browser based, so there is no software to install on the viewing machine, and only a small application to install on the host machine. Their website allows you access to all of the hosts you have installed the software on. Best of all, it's free. Unless there is no other way to do something, I try to avoid opening ports in my firewall. Unless LogMeIn does not provide all of the features you need, I would suggest you use that from both a usability standpoint as well as a security standpoint.

link|improve this answer
I'm afraid I'm not trusting enough to allow a third party website to view the content of my machines, even in screenshot form. There some very expensive, sensitive and time consuming software being developed, and it would be a shame if it leaked or suffered some form of sabotage. Nevertheless, I'll look into it. If they have decent disclaimers, agreements and policies, and I fail to find much negative feedback on it, I will consider it an option, thank you. – Swader May 31 '11 at 10:11
If you're that concerned about security then your current approach is not appropriate. It leaves you open to hacking, especially if you configure it in the default way using only password, and not certificates, to authenticate. Even then, I would be concerned about having those ports open into my network. What you should be doing if you really don't trust LogMeIn is creating a VPN into your network and using VNC from there. My network handles highly sensitive and confidential personal information and I have no problem with using LogMeIn. – bobert5064 May 31 '11 at 10:15
1  
@Swader: my two bits: randomly punching holes in your work firewall along with your user's home firewalls is much more of a security risk than using a reputable 3rd-party remote access solution built on tested/mature Citrix technologies. – gravyface May 31 '11 at 10:17
I see, thanks guys. I'll definitely look into it then. – Swader May 31 '11 at 10:32
1  
LogMeIn actually turned out to be the best solution, thanks bobert. – Swader Jun 11 '11 at 8:05
show 1 more comment
feedback
up vote 0 down vote
  • TCP Port 5900 for VNC
  • TCP Port 22 for SSH
link|improve this answer
Cool, thanks. But what if I have multiple computers on my work LAN, and others want to be able to do this as well? Do I need to open a new port for each one? For example, right now, I have port forwarding set up to port 22 for SSH to go to my computer's local IP, and 5900 the same thing. If I do the same thing for another Mac's local IP, will that work? How will the router know which computer to redirect the request to, if all the IPs will be bound to the same open ports? (22 and 5900) – Swader May 31 '11 at 7:00
If there are more than one system on either side of the networks you mentioned, then you need to provide some additional information as to the types of networks on either side - NAT or routable (assuming the Internet is in between the networks). – user48838 May 31 '11 at 9:06
Updated main question – Swader May 31 '11 at 9:20
feedback
up vote 0 down vote

Couple of things:

  • PCs don't have an SSH server natively; Macs do, but they're not enabled by default.

  • It's not clear what you're trying to do with SSH. Do you want to tunnel VNC over SSH to provide an additional layer of security and encryption?

  • The firewall "knows" where to port forward traffic from the outside in by a combination of ports and IP addresses (there's more to it than that but practically-speaking) so to port forward VNC to your work machines would require port forwarding rule combinations like "TCP 5900 to TCP 5900 of $WorkPC1_IP_Address followed by "TCP 5901 to TCP 5900 of $WorkPC2_IP_Address" and so on for each machine. Note that I'm only changing the TCP port on the outside; each PC still listens on the default VNC port.
    CAVEAT I know that Linksys routers for the longest did not allow allow you to change the destination port on the inside meaning that workstation 2 would need to have the VNC server listening on the same port as the outside (5901) and so on, for each work machine.

In all honesty, I think trying to setup and maintain (securely!) this kind of setup company-wide is likely going to fail. You might bludgeon your way through this for your computers, but having to do this for everyone else is going to painful.

I'd recommend going with something software-based that requires no firewall changes, dynamic DNS, etc. like GoToMyPC. It supports PC-to-Mac, Mac-to-PC, and PC-to-PC.

link|improve this answer
I have activated the SSH service in the Macs now. I am only trying to set this up for 5 of the IT Macs, nothing more, so it won't be anything company wide. A paid solution is not an option, thanks for the heads up though, never heard of the GoToMyPC service. This router allows the port change you mentioned, it gained that feature with the latest firmware upgrade, so I'll do just that, thank you very much! As for why SSH and why VNC, I just want to use both services, separately. Neither is a tunnel for the other. – Swader May 31 '11 at 10:14
@Swader: tunneling VNC over SSH would be more secure, would require less holes in the firewall, and would provide end-to-end encryption of the entire remote session. I'd also use SSH keypairs with passphrases on the private key, because within hours/days of opening up SSH to your Macs, you'll start getting scanned/brute-force password attempts. – gravyface May 31 '11 at 10:24
Looking into alternatives right now, SSH security is way out of my league. – Swader May 31 '11 at 10:32
@Swader: you speak of highly-secret/expensive software, but yet you're willing to jeopardize all that with a cobbled together unsecure remote access setup? – gravyface May 31 '11 at 10:47
Hence me asking here, I am very new at all this. Before doing anything, this is exactly the kind of feedback I was looking for. I had no idea how unsafe this is. – Swader May 31 '11 at 10:52
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.