jaynicklit up Premium Member join:2001-02-06 Sterling Heights, MI |
to StuartMW
Re: How to secure VNC and port 5900That's what I am trying to find out (a better alternative). I took the log entry to mean a successful access attempt. |
|
|
StuartMW
Premium Member
2012-Dec-3 7:17 pm
said by jaynick:I took the log entry to mean a successful access attempt. No. Your router is just telling you that the IP (on the internet) is trying to access this IP on your LAN. That doesn't mean success or failure. VNC should be able to log access attempts. |
|
|
jaynicklit up Premium Member join:2001-02-06 Sterling Heights, MI |
jaynick
Premium Member
2012-Dec-3 7:23 pm
I just thought I see the word attempt or blocked or something like that instead of just LAN access. Wasn't sure what to make of it. Any way I'll use one of the other suggested approaches. |
|
|
StuartMW
Premium Member
2012-Dec-3 7:28 pm
The only thing I can think of, offhand, is to
• Enable port forwarding for 5900.
• Create a firewall rule to block (or only allow) port 5900 accesses from the internet for a single or small range of IP's.
Of course you'd have to know what internet IP(s) you may have (i.e. what are you). The firewall will prevent any port scanners from even reaching your LAN while you'll get through. |
|
jaynicklit up Premium Member join:2001-02-06 Sterling Heights, MI |
jaynick
Premium Member
2012-Dec-3 7:46 pm
said by StuartMW:Of course you'd have to know what internet IP(s) you may have (i.e. what are you). The firewall will prevent any port scanners from even reaching your LAN while you'll get through. Yes, that's the problem with that. |
|
|
StuartMW
Premium Member
2012-Dec-3 8:05 pm
said by jaynick:Yes, that's the problem with that. Yup. Well port forwarding is just a limited workaround to NAT. The intended purpose is to allow servers to appear as though they're directly on the internet (i.e. open to all comers). Again if you secure VNC (or whatever) then any bad guys won't be able to get into your LAN box although any and all requests will get to that box (and rejected if you have good authentication). The choice is up to you. |
|
jaynicklit up Premium Member join:2001-02-06 Sterling Heights, MI |
jaynick
Premium Member
2012-Dec-3 8:17 pm
Bottom line is that all those entries were probes and attempts but not actual access. Correct? and a 63 char random password like I use for my wireless key would be as secure as it could get other than using other ways like mentioned above? |
|
|
StuartMW
Premium Member
2012-Dec-3 8:19 pm
said by jaynick:Bottom line is that all those entries were probes and attempts but not actual access. Correct? Correct. As for passwords it really depends if all 63 chars are being used as angussf pointed out. |
|
dave Premium Member join:2000-05-04 not in ohio
1 recommendation |
to jaynick
said by jaynick:I just thought I see the word attempt or blocked or something like that instead of just LAN access. Wasn't sure what to make of it. Any way I'll use one of the other suggested approaches. You are confusing layers. A TCP connection was successfully established. We presume they were not able to log in, but that's not your router's concern. |
|
jaynicklit up Premium Member join:2001-02-06 Sterling Heights, MI |
jaynick
Premium Member
2012-Dec-3 8:30 pm
said by dave:said by jaynick:I just thought I see the word attempt or blocked or something like that instead of just LAN access. Wasn't sure what to make of it. Any way I'll use one of the other suggested approaches. You are confusing layers. A TCP connection was successfully established. We presume they were not able to log in, but that's not your router's concern. Thanks, dave , yes I got it now and headed to different solution for remote access(ssh). |
|