1

I am trying to screen share to my Mac Server, on my home LAN, remotely via the internet.

I can VNC to my server while on the LAN find with vnc://lanserver:5900.

I am forwarding port 22 from my DSL to the LAN VNC computer.

I can SSH to the LAN PC through the firewall ok.

I can setup the SSH tunnel, logs:

Authenticated to xx.xxx.xxx.xxx ([xx.xxx.xxx.xxx]:22).
debug1: Local connections to LOCALHOST:5901 forwarded to remote address x.x.x.x:5900
debug1: Local forwarding listening on ::1 port 5901.
debug1: channel 0: new [port listener]
debug1: Local forwarding listening on 127.0.0.1 port 5901.
debug1: channel 1: new [port listener]
debug1: channel 2: new [client-session]

When I try vnc://127.0.0.0.1:5901 on the remote machine, I get a timeout error:

lanserver:~ user$ debug1: Connection to port 5901 forwarding to x.x.x.x port 5900 requested.
debug1: channel 3: new [direct-tcpip]
lanserver:~ user$ channel 3: open failed: connect failed: Operation timed out

I'm out of options trying to find out why the connection times out.

Improve this question
3
  • I am authenticating ssh with only a public key pair, no password.
    – mweinmann
    Jan 12, 2014 at 21:52
  • What remote address are you using in the forward (the x.x.x.x in "forwarded to remote address x.x.x.x:5900")? Generally, you should be using 127.0.0.1 there.
    – Gordon Davisson
    Jan 12, 2014 at 22:29
  • That is in the SSH verbose logging I have enabled on the remote machine when logging in. It has my public IP address listed, which is the address to the machine I am trying to vnc into via ssh tunnel.
    – mweinmann
    Jan 12, 2014 at 23:19

1 Answer 1

Reset to default
1

It looks to me like you're using the wrong remote IP address in your tunnel. You should be using -L 5901:127.0.0.1:5900 ....

It's important to realize that the destination IP for the tunnel is where the remote (server) computer forwards the connection to, so 127.0.0.1:5900 means it connects to port 5900 on the server itself.

It looks like you're using ssh -L 5901:PublicIPofServer:5900 ..., which makes the server try to connect to port 5900 on its own public IP. But that's actually the WAN IP of the router the server's behind, so unless that router forwards port 5900 to the private IP of the server (in which case you wouldn't need the SSH tunnel) AND the router supports NAT loopback (aka hairpin NAT), this won't work.

Improve this answer
2
  • I have the router set to fwd to a dmz computer (default host). I can ssh to the public IP without any forwarding through the nat just fine, just vnc will not connect. nmap of the public ip also shows port 5900 open, along with 22, 53, etc, that I have left open.
    – mweinmann
    Jan 14, 2014 at 23:40
  • Your router may not support NAT loopback. What happens if you make the SSH tunnel as I suggested? Also, what happens if you run an nmap port scan of the public IP from the server on the private network?
    – Gordon Davisson
    Jan 15, 2014 at 0:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .