CDE through firewall - what ports needed?

[Tim Krego_1]

I am trying to access a HPUX 11.00 CDE session using ReflectionX.

The 715/75 I have outside the firewall won't start a session from my Win2KPro machine inside the firewall. The CDE session does work when I log in directly to the machine.

I need to find out what ports to open on our Cisco PIX firewall to be able to use CDE.

I have tried to open TCP ports 6000-6002 and still cannot connect. Are there any other TCP/UDP ports I need to open?

Is there a chance that the firewall is not the problem?

Thanks.

[Robin Wakefield]

Hi Tim,

Security issues aside, and depending on your start method:

rlogin = 513
telnet = 23
rsh = 514
rexec = 512
cde = 177

+ 6000 for X-display 0.

Rgds, Robin

[Tim Krego_1]

I opened those ports, assuming they are TCP not UDP ports.

I still cannot connect, telnet does work. I cannot open the display. Do I need to do something on the HP machine to allow CDE sessions to a certain IP?

Still confused.

[Robin Wakefield]

Hi Tim,

Should be udp, sorry.

Rgds, Robin.

[Robin Wakefield]

Tim,

udp for port 177...Robin

[Tim Krego_1]

I think the configuration on our PIX is incorrect for what I am trying to do. I am going to contact our Cisco person to make sure I have everything correct.

[Tim Krego_1]

I checked /var/dt/Xerrors and found the following.

Server open attempt #0 failed for 192.168.1.61:0, giving up

I think I need to translate an outside ip to an inside ip on the firewall.

[Ralf Hildebrandt]

The correct solution is to use SSH on both boxes and to let JUST ssh pass the firewall.

Then you tunnel the ports needed using SSH.

Benefits:

a) less ports open
b) compression
c) encryption
d) no session hijacking
e) ease of use
(no passwords needed)

There are free SSH clients for all platforms, be it OpenSSH for *NIX and TeraTerm for Windoze.

[Tim Krego_1]

I am going to try using SSH. That seems to be a wise choice for ftp, telnet, x security issues.

Do any specific ports need to be open for SSH? I just picked up the O'Reilly SSH book yesterday. I know what I will be doing this weekend. :)