Tunneling X11 via ssh : what to put into access rules for the server?

[Jansen_8]

Hi

I have 2 VMS Alpha (8.3) systems separated by a firewall and many access restrictions on the network.

One acts as X-Server the other is an X-client
To display application on the server I give the following commands on the client:

$ ssh -"L" 6000:client.nl:6000 client.nl
(and logon)
$ set display/crea/node=loaclhost/disp/transp=tcpip

Than I have to fill something into the access securuity of the X-server. I have no idea what to fill in. I tried already both host-names and local host. The only thing that seems to work is allowing all incoming TCPIP X11 requests.
But that is ofcourse not very secure.
1) What should be the proper node-name in this case?
or
2) How can I find out who with what protocol makes connection to my X-server?

Jouk

[Hoff]

Here's how to do this from Mac OS X and other boxes, and including (since you're looking to ssh between OpenVMS boxes) the rather bizarre ssh syntax used on OpenVMS:

http://labs.hoffmanlabs.com/node/134

[Jansen_8]

The normal ssh-tunneling is not going to work since I do not have "direct" ssh access to the client machine. So I have to tunnel port 6000 over ssh back to the server.

[Hoff]

May I presume you have tried the "+X" as described in the referenced web page?

[Steven Schweda]

> I tried already both host-names and local
> host.

What, exactly, did you try? ("*" for the
user?)

> 2)

Perhaps: TCPIP HELP SHOW DEVICE

Knowing actual names and/or IP addresses
might be helpful, too.

[Jansen_8]

Some more explanation. The X-client is on a Vlan reacheable via OpenVPN only. Since OpenVPN does not run on OpenVMS I have to set up a connection via another host. In that case the +x (VMS) or -X/-Y (linux) does not work since the VMS machine thinks the trafic comes from the intermediate host.
The X-server is in a VLAN that does not allow incoming trafic on port 6000.

In the X-server security every thing works if I fill in
node=* User=* Transport=TCPIP

What does not work is
localhost,*,TCPIP
client.nl,*,TCPIP
server.nl,*,TCPIP

So I have no idea what the I should fill in for the node.

[Edwin Gersbach_2]

It's been a while since I used this last, but shouldn't the x-server have the details of the failed connection attempt in a log or error file?

[Jansen_8]

Thanks for all the replies. I finally found out that I had to insert the IP-name of the localhost WITHOUT the domain. That made it work

It would have been better to "translate" all the names in case of TCPIP to the ip-number.