Problem with Controlling a Mac From a Windows PC With TightVNC

MEMBER
POST
Paul H
Joined: Jul 01, 2008
Total Posts: 4
0 Points
Hi Alexia,

I would really appreciate some help getting connected to a friend's iMac running latest OS X from my WinXP PC. Your instructions were the most concise I found, and made it easy for my friend to administer his iMac.

Problem: I get no response from his machine when I attempt to connect using vncviewer from my WinXP PC.

Though I cannot ping his IP address, I do get a blank web page addressing it in Mozilla, as opposed to a "No response" or google search. (So a basic html server is running and serving an empty page by default on an iMac?)

Troubleshooting Info: running full TightVNC package - current version 1.3.9. - since I use it locally. --> Is there a problem if the full package is installed?

Steps Taken:
After connect failure behind my router, disabled my SW firewall, no go. Then I put my PC in the DMZ, still no connect.

His machine is -apparently- properly administered. Under 'Sharing', he has permitted "all users" access with VNC, and has created a strong password. Just in case, I tried accessing using an account that matched his Mac username and password.

His iMac is directly connected and has a public IP address (no router, so no port forwarding issues). Is there any software firewall that might need to be tweaked on his side to allow the server to listen on port 5900?

Alexia, any help is appreciated, and thanks in advance!

Paul H
Alexia Petrakos
Joined: Jun 16, 2007
Total Posts: 196
1050 Points
Thank you for the nice comments about my article. I am glad to try to help. OK, the network administrator in me feels the need to start by saying that having a computer directly connected to the internet without a router is never a good idea. Even if you had a router, you would not want to open ports that allow direct access from the internet to remotely control a computer on your network.

Ideally for any remote access across the internet you would both have routers on your networks and you would set up a VPN connection to his network first. That way all your communication with his network is encrypted and there's a lot less risk of attack. Obviously you have some knowledge of routers and were probably already aware of that, but for the sake of others who may read this post, I felt the need to point that out.

OK, that being said... let's get to the question you asked. To be honest, if he can access his Mac from XP, and your setup is the same as his, and there are no firewalls between you and him... then there is no reason that it should not work. However, the fact that you cannot ping him is making me think that there is some kind of firewall in between. Let's start by eliminating some things.

1. Your router is not the issue (unless it's a $3000 pro router that controls outgoing and incoming traffic) Consumer routers by default are only concerned with incoming traffic. The few consumer routers that do block outgoing traffic are very general in their controls, and if that was the issue you would probably not be able to connect to the internet at all. Putting your PC in a DMZ only impacts how the internet see's you, and not how you see him. So we can eliminate that.

2. His software firewall settings on his Mac. As long as you are using the same credentials as he is, and he can connect with no problem, then it's definitely not his Mac's firewall. So we can eliminate that.

So, let's double check some things to troubleshoot:
1. Re-check his public IP address. Have him go to www.whatismyip.com and it will tell him his public IP address. Try to ping it and see what happens. Does it still time out? Note that if he does not have a static IP service through his ISP, his public IP will change from time to time.

2. What is his setup? Is he using DSL or Cable? Who is his service provider? Is his Mac hardwired directly to a modem? Is he wireless? Is he using an Airport base station? These are important questions because depending on his service provider or his modem type sometimes ISPs block ports and sometimes modems actually have routers and firewalls built into them. Also, if he is using an Airport or other wireless base station, they're really routers in disguise.

3. The fact that you cannot ping him is what makes me think that either the public IP is wrong, or he actually does have a router. Note: that by default a Mac will not refuse ping requests. Normally only routers with "block WAN request" are enabled do that. Your last thing to check, if you still can't ping him and you've confirmed the above, is to do a port scan of his public IP. This is advanced stuff, but if you want to give it a try do a search for superscan or angryip. It might provide some more clues.

That's about all I can think of to try. Hopefully it's just something simple that got overlooked.
Paul H
Joined: Jul 01, 2008
Total Posts: 4
0 Points

Hi Alexia,

First, thank you for your prompt and comprehensive reply! With the holidays, I only saw your reply today.

Points taken re security issues. I've been wanting to learn how to set up VPN tunneling myself, but so much to do . I'm sure there is a 'how to' on this site and will follow-up.

Re his having open remote VNC access, I was counting on limited exposure, a very strong password, and changing of the password after each connect, since I believe VNC passwords are sent unencrypted. Had he a router, I would have used source IP filtering, given my ignorance of VPN setup. Wouldn't that be pretty secure - spoofing can't defeat it without FULL control of an intermediate node?

I've been unable to reach my friend, but a call to Comcast indicates there may be a problem on their end (traceroute searches forever for his system - which is sleeping - I thought the modem would do a link-level ack, and terminate the trace, but the tech didn't know). I will confirm once I've got my friend on the line. They also filter for ports that are often exploited, but he didn't think 5900 was one of them (135 is, for example.

In the meantime, perhaps I did leap to some erroneous conclusion(s) (he does have an Airport Express). His configuration:

1. A new iMac with a direct wired connection to a Comcast modem. I inferred there was no firewall fuctionality, because his TCP/IP panel reports only the public IP address. Comcast confirms their modems don't provide internal routers.

2. He hired an independent mac consultant to set up his config - I agree there is no substitute for a hardware firewall, even if you're on a more secure and less targeted platform such as the Mac (OS X).

3. The consultant later added a remote Airport Express solely for use with iTunes - using WEP encryption, when WPA was available! While visiting, I had made a quick attempt to gateway from my laptop through his iMac's wireless network to the internet, but without success. I was careful to restore settings to initial values. ==> Please tell me if the mere existence of this wireless network might be causing problems.

You said Macs do ack pings 'by default' - how do you control this in Mac OS X? I doubt the consultant would have disabled acks, and doubt he has any add-on firewall software, again suggesting a Comcast problem. Each time I've worked with him, I've had him read me his (public) IP address, so IP re-assignment hasn't been the problem.

BTW, he does NOT have any local peers, including an XP system, to test with.

Many thanks to you, and to your sharing your expertise!

Hope you are having a great July 4 weekend,

Paul H.
Paul H
Joined: Jul 01, 2008
Total Posts: 4
0 Points
Forgot to Ask: Does OS X respond to an http: request with a blank screen by default?

Thanks,
Paul
Paul H
Joined: Jul 01, 2008
Total Posts: 4
0 Points
Alexia,

I got it working. I didn't know abour the new sw firewall in 10.5. Enabling Remote Desktop evidently added it to the specific app list, but his Firewall was set to Essential Apps only. So simply needed to switch from "Essential Apps" to the third option, where Remote Desktop was already in the list.

I also ran into some odd behavior with the mouse button control, but found some vncviewer settings that worked. (3 button mouse emulation, reverse buttons 2and 3)

Thank you again,
Paul Haines
Alexia Petrakos
Joined: Jun 16, 2007
Total Posts: 196
1050 Points
Great! I'm glad everything's working now.