HOWTO: Setting up a VNC to GDM connection

[intangible]

If you're going through a router or even some cable modems, you have NAT setup and you may have to configure port-forwarding.

I'm not sure how much you know about networking, so I'm gonna break it down a little for you.

Here's an setup of someone with a router:

62.45.23.20 (Internet Ip)->Router Outside->Router Internal/Gateway (192.168.0.1)->Desktop External (192.168.0.101) aka NAT.
Your desktop also has the loopback address 127.0.0.1

Try running nmap on all your different IPs (except the gateway), It makes a big difference if it's your Internet IP that's filtering, or if it's your Desktop's NAT that is.

[Blackie_Chan]

Originally Posted by intangible If you're going through a router or even some cable modems, you have NAT setup and you may have to configure port-forwarding. I'm not sure how much you know about networking, so I'm gonna break it down a little for you. Here's an setup of someone with a router: 62.45.23.20 (Internet Ip)->Router Outside->Router Internal/Gateway (192.168.0.1)->Desktop External (192.168.0.101) aka NAT. Your desktop also has the loopback address 127.0.0.1 Try running nmap on all your different IPs (except the gateway), It makes a big difference if it's your Internet IP that's filtering, or if it's your Desktop's NAT that is.

I'm connected to the net using a router (there are 2 computers connected to it). I have setup port forwarding, everything on port 5800-5905 is forwarded to my computer. Should running `nmap My-Internet-IP` tell me that port 5900 is open? because as I wrote earlier, it says that the port is filtered.

[intangible]

We need to see where it's getting blocked... Open a terminal, paste this, and then send me scanlog.txt through private message. This will scan just about everything that could be causing the problem.

This assumes you have nmap and w3m installed and the interface you want to scan is eth0.

echo "Looking up addresses...";IN=127.0.0.1;ON=`ifconfig eth0|grep -Eo \
"inet addr:[0-9.]{7,15}"|grep -Eo "[0-9.]{7,15}"`;IG=`route|grep -Eo "^\
default[ ]{1,}[0-9a-z]{1,}"|grep -Eo "[0-9a-z]{1,}\$"`;IA=`w3m -dump -n\
o-cookie "http://www.showmyip.com/simple/"|grep -Eo "[0-9.]{7,15}"`;ech\
o -en "Starting scan on the following:\n\nInternal\t$IN\nOutter  \t$ON\\
nGateway \t$IG\nInternet\t$IA\n\nResults will be in scanlog.txt\n\nPlea\
se Wait...\n";echo -ne "\nScans started at ">>scanlog.txt; date>>scanlo\
g.txt; echo -e "\nInternal: $IN\nOutter: $ON\nGateway: $IG\nInternet: $\
IA">>scanlog.txt;nmap $IN $ON $IG $IA>>scanlog.txt;echo Done.

Or you could manually scan everything yourself, but this does all the IP address lookups for you .

Anybody else having similar problems, feel free to PM me for help.

[intangible]

Just as a side-note: this is the thing I love most about Unix-like systems, you can combine all these commands, and have them pasted by someone into a terminal instead of having to ask them 100 questions or explain a bunch of different things.

[Blackie_Chan]

Originally Posted by intangible We need to see where it's getting blocked... Open a terminal, paste this, and then send me scanlog.txt through private message. This will scan just about everything that could be causing the problem. This assumes you have nmap and w3m installed and the interface you want to scan is eth0. echo "Looking up addresses...";IN=127.0.0.1;ON=`ifconfig eth0|grep -Eo \ "inet addr:[0-9.]{7,15}"|grep -Eo "[0-9.]{7,15}"`;IG=`route|grep -Eo "^\ default[ ]{1,}[0-9a-z]{1,}"|grep -Eo "[0-9a-z]{1,}\$"`;IA=`w3m -dump -n\ o-cookie "http://www.showmyip.com/simple/"|grep -Eo "[0-9.]{7,15}"`;ech\ o -en "Starting scan on the following:\n\nInternal\t$IN\nOutter \t$ON\\ nGateway \t$IG\nInternet\t$IA\n\nResults will be in scanlog.txt\n\nPlea\ se Wait...\n";echo -ne "\nScans started at ">>scanlog.txt; date>>scanlo\ g.txt; echo -e "\nInternal: $IN\nOutter: $ON\nGateway: $IG\nInternet: $\ IA">>scanlog.txt;nmap $IN $ON $IG $IA>>scanlog.txt;echo Done. Or you could manually scan everything yourself, but this does all the IP address lookups for you . Anybody else having similar problems, feel free to PM me for help.

Thanks for the script, I ran it and was able to find the problem with my setup.

It was actually a stupid mistake on my part. In my router settings, I didn't check a checkbox (which would enable the corresponding virtual server'). I've actually never noticed the checkbox until today.

Now when I run 'nmap My-Internet-IP' I'm told port 5900 is open instead of filtered.

[spacemonkey]

Since you are running it headless, you made sure to disable the local X server to save yourself some memory, right? If not, just comment out the 0=Standard line in the [servers] section in /etc/X11/gdm/gdm.conf.

How would I do this for xdm?

EDIT:
Bah, nevermind....A little fiddling and I figured it out. I just had to comment out the line at the bottom of the /etc/X11/xdm/Xservers file.

[intangible]

Glad you got it; I figured it was either that or a firewall on the computer itself. It's easy to overlook stuff like that, I do it all the time.

[Devi0s]

I actually ended up using x11vnc to do it. Here's how:

First of all, disable Desktop Sharing with Vino under System -> Preferences -> Remote Desktop.

Use synaptic to install x11vnc.

Once x11vnc is installed, you will need to create a password file that x11vnc will use. Do this:

sudo x11vnc -storepassword yourpasswordhere /etc/x11vnc.pass

Now, we need to configure GDM to run x11vnc when it loads:

sudo nano -w /etc/X11/gdm/Init/Default

Add this line to the file:

/usr/bin/x11vnc -rfbauth /etc/x11vnc.pass -o /tmp/x11vnc.log -forever -bg -rfbport 5900

Now, we need to make a change to another file:

sudo nano -w /etc/X11/gdm/gdm.conf

In the [Debug] section, find the line:

#KillInitClients=true

And change it to

KillInitClients=false

Restart gdm (you can just reboot), and you are good to go.

[intangible]

That looks like the newest x11vnc from Breezy, the one from Hoary doesn't have the same options.

[_Pete_]

Originally Posted by Blackie_Chan I'm connected to the net using a router (there are 2 computers connected to it). I have setup port forwarding, everything on port 5800-5905 is forwarded to my computer. Should running `nmap My-Internet-IP` tell me that port 5900 is open? because as I wrote earlier, it says that the port is filtered.

Have you tried to scan you WAN-IP outside of your LAN? I'm have similar setup, Telewell EA400 which is doing to firewalling & NAT for all 4 computers in the LAN. I since the WAN IP is assigned to the telewell itself I can't nmap directly it from inside the LAN. Instead I do that from some other machine out in the WAN to check what is the port status really.