Tunnelling VNC over SSH with PuTTY

[MiniDisc]

Tunnelling VNC over SSH with PuTTY

[Tunnelling over SSH will work with all versions of Smoothwall.]

This page will show you how to tunnel VNC over a secure SSH connection using PuTTY, so you can securely administer computers which are behind your Smoothwall server via the internet.

Information on tunnelling other types of TCP traffic SSH is also provided.

For more information on tunnelling VNC over SSH, or if you're not using PuTTY, have a look at my Tunnelling VNC Over SSH page.

Rather than using the root account for tunnelling traffic over SSH, you can create additional shell user accounts.

VNC:

VNC stands for Virtual Network Computing. It allows you to remotely view and control a PC desktop, and will run on a wide variety of operating systems.

Visit the VNC website for more information, or to download it.

VNC and Security:

Because access to a VNC desktop generally allows access to your whole computer, security is very important.

VNC uses encryption when making an initial connection, and when you login. Once connected, all VNC data is unencrypted, and a malicious user could snoop your VNC session.

There are also a number of VNC scanning programs available, which will scan a subnet looking for PCs which are listening on one of the ports which VNC uses.

Tunnelling VNC over a SSH connection allows you to use VNC to access your computer(s) which are behind your Smoothwall server, with all traffic strongly encrypted, and optionally compressed.

Additionally, no VNC port is ever open to the internet, so anyone scanning for open VNC ports will not be able to find your computers.

When tunnelling VNC over a SSH connection, the only port which you're opening on your Smoothwall server is it's SSH port, 222.

Requirements:

You'll need:

* A Smoothwall installation (obviously...).

* PuTTY 0.52 or later.

* VNC installed on the PC on your green network.

* TCP port 222 opened on your Smoothwall server.

* The red IP address of your Smoothwall server (or a dynamic dns account).

Setting up the Tunnel:

To allow incoming SSH connections via the red interface to your Smoothwall server, you'll have to open TCP port 222 on the "external access" page of your Smoothwall GUI.

You'll also need to have VNC installed on the computer(s) on your green network (ie, behind your Smoothwall) which you want to remotely administer.

The diagram below shows the configuration I'll use to describe the process of tunnelling VNC over SSH.

PC 1 is a Windows PC, with VNC Viewer and PuTTY installed on it.

PC 2 is your Smoothwall server.

PC 3 is a PC behind your Smoothwall server, running VNC Server.

From PC 1, you need to establish a SSH connection with PuTTY, and get PuTTY to forward the VNC port over this SSH connection.

To do this, you need to configure PuTTY as follows:

For the hostname, specify the hostname or red IP address of your Smoothwall server.

Select the SSH protocol, and specify the port as 222.

Then go to the Tunnels configuration, and add a new forwarded port, specifying the source port as 5901, and the destination as <pc>:5900, where <pc> is the name or IP address of the PC on your green network which you want to remotely connect to, 5901 is the port number on local PC which you will be forwarding, and 5900 is the VNC port on your PC on your green network.

Click the Add button to add this forwarded port.

Note that the destination port numbers may need to be modified for your particular configuration. A VNC Server on a Windows PC will listen on port 5900, while the first VNC instance on a Linux server will listen on port 5901, the second on port 5902, etc.

Also note that if you specify a destination hostname instead of an ip address, your Smoothwall server must be able to resolve this hostname.

If you want to save the configuration settings before proceeding, go back to the Session configuration, specify a saved session name, and click the save button.

To connect to your Smoothwall server, click the Open button

When the connection is established, you'll be prompted for a username (specify root) and the root password of your Smoothwall server. Login, and you'll have a ssh prompt on your Smoothwall server.

You now have a secure SSH connection between your Windows PC and your Smoothwall server, and are forwarding port 5901 to port 5900 on your PC on your green network.

Connecting with VNC:

To establish the VNC connection to the PC on your green network, start VNC Viewer on your PC, and connect to port 5901 on localhost (ie, connect to localhost:1), and PuTTY will forward the traffic on port 5901 over the secure SSH link to your Smoothwall server.

You can then safely administer the PCs on your green network over this secure channel.

Tunnelling Other Traffic:

Note that SSH can be used to tunnel most types of TCP traffic, and is certainly not limited to tunnelling VNC.

For example, it's possible to tunnel Terminal Services traffic (aka Remote Desktop in Windows XP) in the same way, by tunnelling TCP port 3389.

Similarly, telnet (TCP port 23), SMTP (TCP port 25), POP3 (TCP port 110), HTTP (TCP port 80), HTTPS (TCP port 443), IRC (typically TCP port 6667), and most other types of TCP traffic can be tunnelled over SSH in the same way.

For most of these, you'll need to keep the source and destination port in the tunnel configuration the same, and then configure the client application to just connect to localhost.

You can also tunnel Smoothwall's HTTPS web interface over SSH, allowing you full remote access to your Smoothwall, but with only the SSH port open.

To do so, you'll need to configure PuTTY to tunnel TCP port 441 to localhost:441, and then use your web browser to go to

Some'>https://localhost:441.

Some Notes on Tunnelling Remote Desktop

When tunning Windows XP's Remote Desktop (RDP) over SSH, you cannot use the Remote Desktop client on a Windows XP desktop to connect to localhost, as the client on Windows XP prevents loopback connections.

The solution to this is to use an alternative IP address for the source port. Instead of specifying 3389 as the source port in PuTTY, specify 127.0.0.2:3389, and specify the destination as described above.

Once you have an SSH tunnel established, use the RDP client to connect to 127.0.0.2, and you should connect to the specified target PC.

Dynamic DNS:

If you want to connect to your Smoothwall server via the internet, you'll need to know its red IP address.

The easiest way to do this is to sign up for a (free) dynamic DNS account, such as no-ip.com.

Refer to the services->dynamic dns page of your Smoothwall GUI to see which ones are supported natively by Smoothwall GPL.

Once you've signed up with a dynamic DNS provider, you'll have to configure your Smoothwall server to register with this provider whenever it establishes an internet connection. This configuration can all be done through the Smoothwall GUI.

Once configured, you'll then be able to connect to the red interface of your Smoothwall server via the internet, using the domain name you signed up with.