Tight VNC… and NAT

agent007se

Hi all,

I have a network which is like that :

internet –--- PFSENSE (192.168.0.1) ----- SWITCH ----- 192.168.0.15

I want to access to the tight vnc server (into 192.168.0.15) (http port : 6969)

I tried NAT port forward (proto tcp, port 6969, nat ip 192.168.0.15 (ext : my public ip), int port 6969) and I let of course the automatic creation of a FW rule.... But that's useless... what's going wrong ??

Thanks ;)

Superman

Something that I find myself often forgetting is to open the Windows XP Firewall to the VNC Server. If you're using TightVNC Server I find that often the program isn't in the list of exceptions and that you have to browse to the program itself to allow it. Of course this is only a problem if you're using XP and have the firewall enabled. ;)

hoba

Check you firewallrules (order is important). Also check status>systemlogs, firewall to see if something is blocking. If the connections show up as blocked click the small icon in front of the line. It will tell you what rule caused the block.

agent007se

Thanks for the help !!

WAN an_IP:some_Random_Port my_IP:my_Single_Port TCP

The firewall blocks this…

But in the wan tab in the firewall rules I put :

TCP any source, any port, any destination, my_Single_Port, any gateway

This normally let the connection enter but it's still blocked... here is the message when I click on the little red cross in the firewall's log :

The rule that triggered this action is :
@47 block drop in log quick all label "Default block all just to be sure."

??? ???

Gertjan

@agent007se:

But in the wan tab in the firewall rules I put :
TCP any source, any port, any destination, my_Single_Port, any gateway

Entering from the WAN (from anywhere from the Internet) into your pFSense Box ?
This is scary….. threated in many posts and as always concludes with a "don't".
If you really have to so:

Try to limit the "From Source" (if you know the connecting IP) - or, at least it's range.
Use VPN or PPPTP to get in. (works great).
Use stuff like port knocking
Limit connection to a x per x seconds.
etc etc.

The rule that triggered this action is :
@47 block drop in log quick all label "Default block all just to be sure."

This is the default final 'hidden' pfsense 'build in' rule that block all and everything that's new and comes from the 'evil outside' (you should permit with rules before this one - with the help of the GUI Firewall section) - this one pulls the plug on everything else.

agent007se

And if I don't know the range of IP's ? In fact, I'd like to connect to my pc : 192.168.0.3 from the outside everywhere in the world to access to my computer trough Tight VNC…

I've done some searches but I didn't find useful things... I'll try with VPN... that's a good idea :D ! Thanks ;)

hoba

The problem is not any source but the any destination that you have in your rule.