I have set up a VNC server/service on my home PC with TightVNC. I have then set up VNC access on my work Mac, and have downloaded Chicken of the VNC as a client. I have created a dyndns host for my home PC.

What else do I need to do to make this work? I keep googling and end up installing more and more software, to no avail. The documentation on this issue is so scarce I'm surprised anyone but the most hardcore of pros can set this up.

Which ports do I need to open on which ones of my routers? Do I need to set up something special for dyndns? I would like to be able to both SSH and VNC both of my machines from the other.

Are there any solid guides anywhere on mutual PC-Mac remote access?

Edit: info on networks in question

The work environment is a wireless network on a Linksys WRT54GL. The connection is a synchronous DSL connection with a static IP. There are 10ish computers on it, of which 5 of them will need VNC/SSH access from the outside. On the router, static local IPs have been set up.

The home environment is a LAN, on a regular DSL with a dynamic IP. DynDNS has been set up on it, and ports 5900 and 22 opened on TCP for SSH and VNC access, and directed to the local IP of the home PC.

The end goal is each of us being able to connect to our work machines via VNC and SSH, and vice versa. I have succeeded in VNCing home from work. SSH reports "no response", even though the port is opened at home.

Not sure about NAT or routable. Internet is between the networks.

Edit 2:

I imagine I could forward multiple ports, then the SSH setup would be thus: User 1: external port: 22, internal port: 22, local IP: user1's local IP User 2: external port: 23, internal port: 22, local IP: user2's local IP User 3: external port: 24, internal port: 22, local IP: user3's local IP etc... But this feels more like a hack of some sort. Is this the right way to approach it?

migrated from serverfault.com May 31 '11 at 10:08

This question came from our site for system and network administrators.

  • You realize that PCs don't come with an SSH daemon ("server") and that Mac's are disabled by default? – gravyface May 31 '11 at 9:45
  • I did not realize that, no. That is useful information. I'll google around on how to enable those. – Swader May 31 '11 at 9:52

In this situation I would recommend just using LogMeIn. It is a simple to use, secure remote desktop solution that works PC-PC, Mac-Mac, PC-Mac, and Mac-PC. It is browser based, so there is no software to install on the viewing machine, and only a small application to install on the host machine. Their website allows you access to all of the hosts you have installed the software on. Best of all, it's free. Unless there is no other way to do something, I try to avoid opening ports in my firewall. Unless LogMeIn does not provide all of the features you need, I would suggest you use that from both a usability standpoint as well as a security standpoint.

  • I'm afraid I'm not trusting enough to allow a third party website to view the content of my machines, even in screenshot form. There some very expensive, sensitive and time consuming software being developed, and it would be a shame if it leaked or suffered some form of sabotage. Nevertheless, I'll look into it. If they have decent disclaimers, agreements and policies, and I fail to find much negative feedback on it, I will consider it an option, thank you. – Swader May 31 '11 at 10:11
  • If you're that concerned about security then your current approach is not appropriate. It leaves you open to hacking, especially if you configure it in the default way using only password, and not certificates, to authenticate. Even then, I would be concerned about having those ports open into my network. What you should be doing if you really don't trust LogMeIn is creating a VPN into your network and using VNC from there. My network handles highly sensitive and confidential personal information and I have no problem with using LogMeIn. – Kyle Gibbons May 31 '11 at 10:15
  • 1
    @Swader: my two bits: randomly punching holes in your work firewall along with your user's home firewalls is much more of a security risk than using a reputable 3rd-party remote access solution built on tested/mature Citrix technologies. – gravyface May 31 '11 at 10:17
  • I see, thanks guys. I'll definitely look into it then. – Swader May 31 '11 at 10:32
  • 1
    LogMeIn actually turned out to be the best solution, thanks bobert. – Swader Jun 11 '11 at 8:05

Couple of things:

  • PCs don't have an SSH server natively; Macs do, but they're not enabled by default.

  • It's not clear what you're trying to do with SSH. Do you want to tunnel VNC over SSH to provide an additional layer of security and encryption?

  • The firewall "knows" where to port forward traffic from the outside in by a combination of ports and IP addresses (there's more to it than that but practically-speaking) so to port forward VNC to your work machines would require port forwarding rule combinations like "TCP 5900 to TCP 5900 of $WorkPC1_IP_Address followed by "TCP 5901 to TCP 5900 of $WorkPC2_IP_Address" and so on for each machine. Note that I'm only changing the TCP port on the outside; each PC still listens on the default VNC port.
    CAVEAT I know that Linksys routers for the longest did not allow allow you to change the destination port on the inside meaning that workstation 2 would need to have the VNC server listening on the same port as the outside (5901) and so on, for each work machine.

In all honesty, I think trying to setup and maintain (securely!) this kind of setup company-wide is likely going to fail. You might bludgeon your way through this for your computers, but having to do this for everyone else is going to painful.

I'd recommend going with something software-based that requires no firewall changes, dynamic DNS, etc. like GoToMyPC. It supports PC-to-Mac, Mac-to-PC, and PC-to-PC.

  • I have activated the SSH service in the Macs now. I am only trying to set this up for 5 of the IT Macs, nothing more, so it won't be anything company wide. A paid solution is not an option, thanks for the heads up though, never heard of the GoToMyPC service. This router allows the port change you mentioned, it gained that feature with the latest firmware upgrade, so I'll do just that, thank you very much! As for why SSH and why VNC, I just want to use both services, separately. Neither is a tunnel for the other. – Swader May 31 '11 at 10:14
  • @Swader: tunneling VNC over SSH would be more secure, would require less holes in the firewall, and would provide end-to-end encryption of the entire remote session. I'd also use SSH keypairs with passphrases on the private key, because within hours/days of opening up SSH to your Macs, you'll start getting scanned/brute-force password attempts. – gravyface May 31 '11 at 10:24
  • Looking into alternatives right now, SSH security is way out of my league. – Swader May 31 '11 at 10:32
  • @Swader: you speak of highly-secret/expensive software, but yet you're willing to jeopardize all that with a cobbled together unsecure remote access setup? – gravyface May 31 '11 at 10:47
  • Hence me asking here, I am very new at all this. Before doing anything, this is exactly the kind of feedback I was looking for. I had no idea how unsafe this is. – Swader May 31 '11 at 10:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.