dslreports logo
 
    All Forums Hot Topics Gallery
spc
uniqs
23

jaynick
lit up
Premium Member
join:2001-02-06
Sterling Heights, MI

jaynick to StuartMW

Premium Member

to StuartMW

Re: How to secure VNC and port 5900

That's what I am trying to find out (a better alternative). I took the log entry to mean a successful access attempt.

StuartMW
Premium Member
join:2000-08-06

StuartMW

Premium Member

said by jaynick:

I took the log entry to mean a successful access attempt.

No. Your router is just telling you that the IP (on the internet) is trying to access this IP on your LAN. That doesn't mean success or failure. VNC should be able to log access attempts.

jaynick
lit up
Premium Member
join:2001-02-06
Sterling Heights, MI

jaynick

Premium Member

I just thought I see the word attempt or blocked or something like that instead of just LAN access. Wasn't sure what to make of it. Any way I'll use one of the other suggested approaches.

StuartMW
Premium Member
join:2000-08-06

StuartMW

Premium Member

The only thing I can think of, offhand, is to

• Enable port forwarding for 5900.

• Create a firewall rule to block (or only allow) port 5900 accesses from the internet for a single or small range of IP's.

Of course you'd have to know what internet IP(s) you may have (i.e. what are you). The firewall will prevent any port scanners from even reaching your LAN while you'll get through.

jaynick
lit up
Premium Member
join:2001-02-06
Sterling Heights, MI

jaynick

Premium Member

said by StuartMW:

Of course you'd have to know what internet IP(s) you may have (i.e. what are you). The firewall will prevent any port scanners from even reaching your LAN while you'll get through.

Yes, that's the problem with that.

StuartMW
Premium Member
join:2000-08-06

StuartMW

Premium Member

said by jaynick:

Yes, that's the problem with that.

Yup. Well port forwarding is just a limited workaround to NAT. The intended purpose is to allow servers to appear as though they're directly on the internet (i.e. open to all comers).

Again if you secure VNC (or whatever) then any bad guys won't be able to get into your LAN box although any and all requests will get to that box (and rejected if you have good authentication).

The choice is up to you.

jaynick
lit up
Premium Member
join:2001-02-06
Sterling Heights, MI

jaynick

Premium Member

Bottom line is that all those entries were probes and attempts but not actual access. Correct? and a 63 char random password like I use for my wireless key would be as secure as it could get other than using other ways like mentioned above?

StuartMW
Premium Member
join:2000-08-06

StuartMW

Premium Member

said by jaynick:

Bottom line is that all those entries were probes and attempts but not actual access. Correct?

Correct.

As for passwords it really depends if all 63 chars are being used as angussf See Profile pointed out.
dave
Premium Member
join:2000-05-04
not in ohio

1 recommendation

dave to jaynick

Premium Member

to jaynick
said by jaynick:

I just thought I see the word attempt or blocked or something like that instead of just LAN access. Wasn't sure what to make of it. Any way I'll use one of the other suggested approaches.

You are confusing layers. A TCP connection was successfully established. We presume they were not able to log in, but that's not your router's concern.

jaynick
lit up
Premium Member
join:2001-02-06
Sterling Heights, MI

jaynick

Premium Member

said by dave:

said by jaynick:

I just thought I see the word attempt or blocked or something like that instead of just LAN access. Wasn't sure what to make of it. Any way I'll use one of the other suggested approaches.

You are confusing layers. A TCP connection was successfully established. We presume they were not able to log in, but that's not your router's concern.

Thanks, dave See Profile, yes I got it now and headed to different solution for remote access(ssh).