[/os/chrome] permanent link

1. Click on the Apple symbol at the upper, left-hand corner of the screen.
2. Select System Preferences.
3. Select Sharing under Internet & Network.
4. Start Apple Remote Desktop and set the appropriate privileges for it as detailed at Configuring a Mac OS X 10.6 System to Provide VNC Access.

But when I tried establishing a VNC connection to the system from another system on the same LAN, I could not establish the connection. Yet I could establish a VNC connection when I attempted to do so through an SSH tunnel, which led me to believe that the firewall software running on the eMac was blocking the connection.

I went to Sharing again on the system and selected Apple Remote Desktop and then clicked on the Firewall tab. I clicked on the padlock icon so I could edit the firewall settings. I then saw a message telling me that I couldn't change the settings when I clicked on Edit.

You cannot change the firewall settings for this service.

When you turn on Apple Remote Desktop in the Services pane, you also allow the service access through the firewall on TCP port(s) 3238 and UDP port(s) 3238. To stop access through the firewall you must turn off this service through the Services pane.

I didn't see a reference to the default VNC port of 5900, so I opened a terminal window to check the firewall rules (Applications - Utilities - Terminal) using the ipfw command. The command has to be issued while logged into an account that has administrator access on the system.

Maroon-Apple:~ JDoe$ sudo ipfw list
Password:
02000 allow ip from any to any via lo*
02010 deny ip from 127.0.0.0/8 to any in
02020 deny ip from any to 127.0.0.0/8 in
02030 deny ip from 224.0.0.0/3 to any in
02040 deny tcp from any to 224.0.0.0/3 in
02050 allow tcp from any to any out
02060 allow tcp from any to any established
02065 allow tcp from any to any frag
02070 allow tcp from any to any dst-port 3238 in
02080 allow tcp from any to any dst-port 22 in
02090 allow tcp from any to any dst-port 548 in
02100 allow tcp from any to any dst-port 427 in
02110 allow tcp from any to any dst-port 139 in
02120 allow tcp from any to any dst-port 631 in
02130 allow tcp from any to any dst-port 515 in
12190 deny tcp from any to any
65535 allow ip from any to any

I could see that connections to port 3238 were allowed, but there was no entry for port 5900, though the system was listening on port 5900 as a netstat -an command verified.

Haroon-Apple:~ Jim$ netstat -an | grep 5900
tcp4       0      0  *.5900                 *.*                    LISTEN

To resolve the problem, with the Firewall tab selected under Sharing, I clicked on the New button. I then selected VNC for Port Name, which automatically selected TCP ports 5900-5902 and UDP port 5900.

VNC then appeared in the list of services in the firewall window with a checkmark next to it. When I checked the firewall rules with the ipfw list command, I also saw ports 5900 to 5902 listed.

$ sudo ipfw list
Password:
02000 allow ip from any to any via lo*
02010 deny ip from 127.0.0.0/8 to any in
02020 deny ip from any to 127.0.0.0/8 in
02030 deny ip from 224.0.0.0/3 to any in
02040 deny tcp from any to 224.0.0.0/3 in
02050 allow tcp from any to any out
02060 allow tcp from any to any established
02065 allow tcp from any to any frag
02070 allow tcp from any to any dst-port 3238 in
02080 allow tcp from any to any dst-port 22 in
02090 allow tcp from any to any dst-port 548 in
02100 allow tcp from any to any dst-port 427 in
02110 allow tcp from any to any dst-port 139 in
02120 allow tcp from any to any dst-port 5900-5902 in
02130 allow tcp from any to any dst-port 631 in
02140 allow tcp from any to any dst-port 515 in
12190 deny tcp from any to any
65535 allow ip from any to any

I was then able to successfully connect to the system from another Mac by putting vnc://192.168.0.103 in the address bar of Safari (192.168.0.103 was the address of the system functioning as a VNC server). When prompted for login credentials, I could put in the userid and password of an account on the system functioning as the VNC server and log into it.

[/os/os-x] permanent link