2

I wish to be able to connect to my windows box with VNC. I installed TightVNC and freesshd. I set up TightVNC to serve on 5899, and freesshd to serve on 2223. (TightVNC advice on port forwarding.)

If I port forward 5899 and 2223 on my router, I can connect both directly (on 5899) and through ssh port forwarding:

ssh -p 2223 -L 5699:<myip>:5899 myaccount@<myip>

and connecting to localhost:5699. So far so good.

However, if I close port 5899 on my router, I can't connect even using ssh port forwarding. I get this message on the windows console that I have ssh-ed to:

channel 3: open failed: connect failed: Connect failed

Looking in the logs shows a lot of stuff I don't understand. "ssh -v" shows that it is trying to port forward local 5699 to remote 5899, which is correct.

I'd like to close 5899 if I can, because that is an open VNC port without an account name, it just has a VNC password (with a length restricted to 8 characters!). Seems insecure.

How do I close 5899 and still be able to connect via ssh tunneling?

Note: I read Why can't I connect to my VNC server from outside my network? and didn't see how to apply the advice there.

Improve this question
3
  • i'd guess that closing port 5899 in the router should not cause that error when you ssh. You need port 2223 open on the router for the ssh to work. You could change 5899 to almost anything between 1-65535 and maybe anything between there, and i'd think it should not make any difference to the success of the ssh command.
    – barlop
    Dec 23, 2012 at 2:39
  • 2
    I see a problem of you putting <myip> here 5699:<myip>:5899. I am not sure if that'd cause that error, maybe it would, but it does look like a mistake. The end that runs sshd is I suppose the one with your VNC server. So the end with sshd should forward to 127.0.0.1 and not through any router. So it should be 5699:127.0.0.1:5899 some routers allow you to e.g. ping your public ip from within, and I don't know if that'd go through the internet or just do it privately, but it makes more sense here to use 127.0.0.1 And yeah port 5899 should not be open on your router.
    – barlop
    Dec 23, 2012 at 2:41
  • You're a genius! I used 5699:127.0.0.1:5899 and ssh port forwarding worked even with 5899 closed. Submit that as an answer, and I will accept.
    – dfrankow
    Dec 23, 2012 at 16:49

1 Answer 1

Reset to default
1

Answering here with my comment that solved it.

I see a problem of you putting <myip> here 5699:<myip>:5899. I am not sure if that'd cause that error, maybe it would, but it does look like a mistake. The end that runs sshd is I suppose the one with your VNC server. So the end with sshd should forward to 127.0.0.1 and not through any router. So it should be 5699:127.0.0.1:5899 some routers allow you to e.g. ping your public ip from within, and I don't know if that'd go through the internet or just do it privately, but it makes more sense here to use 127.0.0.1 And yeah port 5899 should not be open on your router.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .