telneting Personal alpha from a different network.

[Joewee]

I have personal alpha installed on my Microsoft XP. The setup is
ADSL Router ---> 5 port Switch -----> (WIN XP) 2 Ethernet cards, one given exclusively for Personal alpha.


Now everything is fine in LAN. Telnet,FTP.. etc.

I got a little curious to find out whether I can connect to my Personal alpha from a different network, from my laptop which has a different ISP.

I opened port on my ADSL router to try this out. From the time i opened ports. I'm getting lot message like this


$
%%%%%%%%%%% OPCOM 28-NOV-2009 04:10:35.11 %%%%%%%%%%%
Message from user AUDIT$SERVER on JOSE1
Security alarm (SECURITY) and security audit (SECURITY) on JOSE1, system id: 104
0
Auditable event: Remote interactive login failure
Event time: 28-NOV-2009 04:10:35.10
PID: 00000124
Process name: _TNA11:
Username:
Process owner: [SYSTEM]
Terminal name: _TNA11:, Host: 189.27.170.238 Port: 2948
Image name: JOSE1$DKA0:[SYS0.SYSCOMMON.][SYSEXE]LOGINOUT.EXE
Remote node id: 4004125629 (6.957)
Remote username: TELNET_BD1BAAEE
Status: %LOGIN-F-CMDINPUT, error reading command input



Who are these people? Hackers?? Trojans??

The bad part is, im not able to telnet to this server. But im wondering how do these guys get in.

When i telnet my WAN IP address it takes me to ADSL router login. If i forward different port say for example 1020, then im not able to telnet.

Please help.

[Steven Schweda]

> I opened port on my ADSL router [...]

What, exactly, did you do? What is your
DSL router?

> But im wondering how do these guys get in.

They might be talking to some port on your
router which the router forwards to port 23
on the Alpha emulator. Apparently, talking
to port 23 on the router gets you to the
router. My psychic powers are too weak to
tell me all about how your router is
configured, so I have no idea how they get to
port 23 on the Alpha emulator.

> If i forward different port say for example
> 1020, then im not able to telnet.

"I'm not able" is not a useful problem
description. What, exactly, did you do, and
what, exactly, happened when you did it?

[Hoff]

The box looks to be looped back to itself somehow. That audit shows 189.27.170.238 as both the source and destination.

[Joewee]

Thanks for you replies.

Steven,

This is what i did.

I have UTSTARCOM WA3002-g1 ADSL router. In that i went to advanced setup -----> NAT ----> Virtual server----> (see the attachment). 192.168.1.35 is my Alpha emulator.


Hoff,

Its looping back? So how to pin down to this. IT was not from single IP address and one port. I got such request from many IP's and from different ports each time. I tried to ping those IP's back, I got replies from them.

Please correct me if im wrong. This is getting very interesting for me. Im very curious to get this done :).

Joe

[Joewee]

And I did one more thing. Please see the attachment.

[Hoff]

This question has little or nothing to do with OpenVMS; it could be Windows Server, Unix or most anything else behind this device and on the receiving end of telnet (or whatever) port-forwarding.

You can better work with this device by first trying to establish in-bound telnet connections (port-forwarding) to something other than this OpenVMS box; get the emulator (and its complexity) entirely out of the mix here.

The images are of the router configuration screens from this UTStarcom WA3002-G1 device; you'll want to acquire and read the manual for that device.

I've dug around with Google for a few minutes on your behalf (and which will be the limit of my investigation here) and did find a few discussions of port-forwarding for and a few reports of configuration problems with this widget. I also note that the UTstar folks do not seem to have manuals overtly posted anywhere, which is unfortunate. And the box apparently needs to be power-cycled before the settings take effect?

Contact your ISP, and ask for assistance with port-forwarding.

And if somebody else wants to step in here, have at.

[Steven Schweda]

> 192.168.1.35 is my Alpha emulator.

What's the IP address of the router? (LAN,
WAN)?

I know nothing about this particular router,
but some years ago, my telco tried to sell me
some piece of junk (ActionTec?) which simply
refused to forward port 23 (Telnet) when I
told it to. My Cisco 678 does it properly.

You might try telling it to forward some port
other than 23 (like, say, 623) to port 23 on
the emulator, and then see what happens when
you try Telnet to that port (on the router).

If I were testing something like this, I
would probably not begin by enabling anything
called "Access Control".

> [...] im not able to telnet [...]

I still don't know what this means. Showing
actual commands with their actual output can
be more helpful than vague descriptions and
interpretations.

[Joewee]

Hoff,

Many thanks for your time on this. Yes, I will learn more about this port-forwarding stuff and in bound TELNETTing as per your advice. And will keep you posted. Thanks a lot again.

Steven,

Thanks for your reply.

IP address Information.

WAN: Dynamic Public IP's. When ever i reboot my ADSL router it will change. Else it remains same may be for hours, days. I don know the lease time.

LAN: Router's IP : 192.168.1.1
Ethernet card 1 : 192.168.1.33 Dynamic ( Used by windows)
Ethernet card 2 : 192.168.1.34 Dynamic ( this Ethernet card is given exclusively to Personal alpha)
Personal Alpha : 192.168.1.35 Static ( I have set using @sys$manager:tcpip$config )


Im sorry this is getting completely out of VMS. But i will tell you what was my plan. I might have thought real stupid. Anyway I will tell you.

Everything is working fine in LAN ( TELNET, FTP...), so wanted to check the same from different network. I tried to ping google's IP address from my personal alpha, it went fine. So now the personal alpha can communicate out of my network. Outbound is fine.

Now, the idea is to TELNET 59.92.48.207(example) which will be the WAN IP address at that moment on my ADSL router.

Then I wanted my ADSL router to send all the TELNET request to 192.168.1.35 i.e Alpha emulator.

(I donno whether I was correct), for that only I opened port 23 for the ip address 192.168.1.35 on advanced setting on my ADSL router. And in ACL added TELNET input from any IP address.

Now if i TELNET 59.92.48.207(example), IM getting password prompt for my ADSL router. Which gets me in to configuration console of my ADSL router. So I thought of doing TELNET 59.92.48.207 1024 ( Port number). So I forwarded that port 1024 on the ADSL router, but then when i do telnet with port number, it gets connection timed out. That's why i mentioned

" [...] im not able to telnet [...] "

The thing which made me more interesting in to this was. As soon as i opened the ports to that ip 192.....35. I got few telnet requests from different public IP addresses to my personal alpha and all from different ports.
So I thought it is definitely possible to telnet my personal Alpha from outside Network, but im doing something wrong.

Now im gonna learn more about this Port forwarding and TELNETTing behind this ADSL router stuff.

Please gimme your suggestions.


Im very sorry for such a long explanation. Also forgive me, if any sentence is wrong, im not that good in this.


Joe

[Willem Grooters]

If you attempt to access your PA from the Internet, I would _strongly_ suggest NOT to use telnet. It lacks security - by design. Use SSH instead. It takes some setup on the VMS side, but on the netwerk side, it's no difference.

On your ADSL router setup:
Telnet is set on port 23, SSH on 22. On VMS, LEAVE IT THERE. It can be changed but the configuration scripts need to be adjsuted, and this is error prone (and can leave you IP correpted you you wouldl have tio redo it all (after removeing the files involved)).

The easy (and imho) easy way is to adjust your router. Deternmine an arbitray port on your router to handle the protocol you want to use, and forward that to the right port on VMS. Then specify the port in yout TELENT of SSH commands.

example:
assume your router has been set to accept telnet acces on port 1234, and your IP _outside_address is 111.222.333.444 (invalid, I know :)).

telnet 111.222.333.444 1234

of, if your domain is on the global DNS:

telnet 1234

It may depend on your router setup, but I can use the same command from my LAN as from the internet. In VMS, the difference is shown by the address: external if from the Internet, of the routre's internal address when from the LAN (where I use the external DNS name).

HTH

[Joewee]

Hi HTH,

Thanks. Yes, i will try to do the same. Im little held up in my work now. Will try to work on this coming weekend.

Many thanks for all your suggestion. will keep you all posted.

Thanks,
Joe