Read EVERYTHING, still can't connect! DSM 1.2.2!

[garciam25]

i used to be able to use VNC just fine on the LAN, but couldn't get it to connect through the internet.... thought i fixed it yesterday by port forwarding my router and connecting using the IP::5900 trick.... worked just fine while i was still at my house, using the LAN, so i figured everything was going to work while i was at the office.... i was NOT using any DSM at the time

i get to the office today, and tried everything! i READ everything i could, and this is what i've got accomplished so far:


Using UltraVNC v1.0.2

Port forwarded my router to 5900 ==> my computer's internal IP address (192.168.1.101)

Using MSRC4Plugin_NoReg.dsm v1.2.2

generated the rc4 key using the Viewer, copied the key into the Viewer directory and the Server directory

configured both the Viewer and Server using the rc4 key, and both have been found, not using password anymore

closed both the Viewer and Server, CAD to do End Process on any remaining viewerVNC processes

running a sub 8 digit password on the Server side

configured Symantec to accept ports 5900 and 5800 - even shut it all the way down to test it, and it still won't work.... also configured Windows Firewall for Server and Viewer to be exceptions


and i STILL cannot connect - now i can't even connect on LAN at my house! what do i need to provide to assist with any help needed? i've seen people post logs before, but i didn't see where or how to do that, so please walk a noob through this!

thanks in advance, don't know what else to do since it looks like i've done everything possible!!!

[bevtech]

your office network maybe complex and will not work..

Some tips

When in a home network (LAN) use your internal ips..

Start at the home side and make sure that you can get it working before you try to configure it for wan access..

Does it work without encyption??? If not then something is missconfigured..
If so then dsm configuration is wrong.

What do you mean that you are not using password anymore??

Also try disabling iternet worm protection in NAV..

[garciam25]

bevtech,

thanks for the QUICK reply! i may have been too much in a hurry, didn't clarify myself, so i'll do so now....

my office network is probably LESS complex then my home network - its just a DSL modem going into a wireless router, whereas my home network is a cable modem going into a router and repeated a bunch of times, WAP encrypted a little further, etc etc etc.... not surprised that it works "internally" using LAN and not over the internet connection though, so that was my issue and concern

i had been using my internal IP address over the LAN, but obviously that won't work too well over the internet, so i tried using the IP::5900 way internally, and it worked just fine last night when i was at home using it.... now, using the DSM plugins, everything is screwed up! i can't get it to connect using the internal IP address anymore, even if i say on both computers NOT to use the MSRC4Plugin_NoReg.dsm v1.2.2 plugin!

i am almost sure something is wrong with the DSM configuration - but how can that be? i literally JUST uninstalled both the Viewer and Server from both comptuers, and tried all over again, put in the key from the Viewer Laptop and transfered it to the Server PC to no avail....

when i said "no password," it says in the Server side if you don't have a key present "No key found - Using password," so i'm not JUST on the password, i'm using both the key and password....

i couldn't find the setting in Norton AV to turn off internet worm protection.... any help? i've literally shut the entire program down already - more importantly, i didn't have to do that before when i was on LAN using the port forwarding, so that shouldn't be the issue.... only the laptop (Viewer) has NAV installed, the Server PC does not....

so far, the best i've been able to get out of the system is hanging on "Negotiate Protocol Version" or a few times getting me to the password window, putting in the CORRECT password, and it giving me Invalid Protocol errors....

i just tried running the "testserver" and "testviewer" files to see if those would help any - haven't had any luck with it, but my viewer is now running a log if that helps any!

[redge]

i've seen people post logs before, but i didn't see where or how to do that, so please walk a noob through this!

Trouble-shooting
http://msrc4plugin.home.comcast.net/tro ... oting.html
and UltraVNC FAQ
[topic=7563][/topic]

i can't get it to connect using the internal IP address anymore, even if i say on both computers NOT to use the MSRC4Plugin_NoReg.dsm v1.2.2 plugin!

Maybe mistake config or misspelling your shortcut or command line.
or maybe total other problem not related to UltraVNC and dsmplugin.
please look at your windows event viewer, maybe, could help you.

when i said "no password," it says in the Server side if you don't have a key present "No key found - Using password," so i'm not JUST on the password, i'm using both the key and password....

the key is wrong misspelling or wrong under sub directories always failing because can't be found, the key and the msrc4plugin.dsm 1.2.2.0 must on the same place of UltraVNC Server and UltraVNC Viewer (not anyway into sub folder) (you need to move the plugin yourself to main place of the UltraVNC



step by step for configure MSRC4Plugin_noreg.dsm 1.2.2.0 for only UltraVNC
[topic=3049][/topic]

[redge]

so far, the best i've been able to get out of the system is hanging on "Negotiate Protocol Version" or a few times getting me to the password window, putting in the CORRECT password, and it giving me Invalid Protocol errors....

Are you sure your VNC password not exceed 8 caracters at all ???


from UltraVNC FAQ
[topic=7349][/topic]
[topic=3276][/topic]

UVNC 3.3.6 based alpha/numerical password is 8 caracters maximum
(no respect this point should always fail with dsmplugin enabled)

[eagle13]

Wow this sounds as close to home as it can get!

I set up an encrypted tunnel for a client, so that they could access a work workstation from home.
Did all that you did, almost in that order, and for a little bit of time it worked fine.

Then it stopped....

I was pulling my hair out trying to understand what had gone wrong. Was it the NIS 2005 on the host PC? Worm protection as so many ppl had mentioned in previous threads?

Turns out for my particular instance that the DSM plugin had somehow 'unticked' itself in the server config!

So here I am trying to connect to a server that has no encryption enabled, from a viewer that did!

The answer was in plain sight, but I was thinking it was something difficult and complex.
Can I ask you, does your connection work without any encryption enabled?
If it does, then you have isolated the issue.

[garciam25]

alright, finally made two seconds available to try and figure this thing out again, and STILL cannot get it to work.... going away on business again tomorrow morning, and would LOVE to have access to my desktop remotely - especially considering i'll be out of the U.S.!

i have the DSM installed correctly, and i have the key in the correct place, KEY FOUND on both computers.... this, all coming after uninstalling the entire thing, downloading a fresh copy, and reinstalling everything all over again.... the WORST part is that i'm sitting right next to my desktop on my laptop and cannot connect via LAN with NO encryption, as eagle13 just asked if i could.... WHYYYYYYYY???

the password is correct, less than 8 characters - i've TRIPLE checked it! i keep getting the same error message - Error Reading Protocol Version! both with the _NoReg.dsm checked USE and without! when i don't have the _NoReg.dsm plugin selected on both the viewer and server, it says something on the error, besides the suggestion to USE a DSM plugin, about an RFB protocol and the server and viewer possibly not being compatible? what's that all about, how is that possible if they're the same program copied from ONE download? there is NO reason why this shouldn't work since it was working just fine......

please help! thanks!

[redge]

corrupted data and and wrong UltraVNC build ?

[garciam25]

not sure how that would be possible, considering i'm downloading a new, fresh copy of 1.0.2 from the sourceforge website..... suggestions?

[bevtech]

You mentioned that you have a cable connection?? Who is the ISP if I may ask??

[garciam25]

Road Runner

[bevtech]

Not sure if they limit the ports above >1024. but that wouldnt have any issue on LAN problems.


you dont by chance have the mslogon checked or configured mslogon then unchecked??

[garciam25]

i had tried to configure the MSLogon one time, but didn't want to use it, and unchecked it - but that was on a previous installation, and don't have any MSLogon configured for the current installation.... i looked at the setup screen for it, and it doesn't have any usernames listed, so MSLogon is not configured....

[scovel]

You said in one of your above posts that you cannot connect WITHOUT the plugins? Is that still true? If so, you need to get that working first. First over the LAN, and then from the office. If that is working, then get the plugins working. Otherwise its just too confusing to troubleshoot exactly what is going on.

Sean

[garciam25]

wow, that's interesting..... not only can i NOT connect without any plugins attached (connected, detected, not sure what the proper term is), but when i have completely deleted the plugins, thus the program says "No Plugins Detected..." close and restart the program, and try to connect via LAN using the local IP, i get the error message saying i have failed to select a DSM plugin!!!

BOTH the server and viewer have NO plugins detected, and i'm still getting this message! what am i doing wrong here????

[bevtech]

Are you only dealing with one type of OS or are you cross platforming (win98, win2000 etc)??

[garciam25]

both computers are using WinXP SP2 - one is the Media Center edition, but that isn't important i believe....

[redge]

delete content of prefetch folder then restart computer.
check your computer memory for memory failure /hard disk for bad sector
look the event viewer if there software/hardware error.

[garciam25]

windows/prefetch contents have been deleted on BOTH viewer and server computers

memory is good on both computers, both are aftermarket, but have been checked out recently and are not experiencing any trouble

the event viewer only had "Information" for WinVNC, which stated the login / logoff times when i was able to connect the viewer to the server--a month ago!

STILL getting the same error, telling me i need to have a DSM plugin selected to connect to the server, even though there are no plugins currently being detected on EITHER the viewer or server computers!!!

[redge]

STILL getting the same error, telling me i need to have a DSM plugin selected to connect to the server, even though there are no plugins currently being detected on EITHER the viewer or server computers!!!

Maybe you don't understand the difference ?
there the exact error you have ?

is a possible cause not a cause !
Possible causes:
- You've forgotten to select a DSMPlugin and the server uses a DSMPlugin
- Viewer and Server are not compatible ...
- Bad connections

[jftuga]

Since you are having a run of bad luck, may I suggest UVNC + stunnel? I have used this combination with great success. Basically, you have stunnel (www.stunnel.org) listening on a local port, say port 23456, on the client side. Tell your vncviewer to connect to 127.0.0.1:23456.

On the remote end, configure stunnel to listen on port 23456 and forward to local port 5900. You have to configure winvnc to allow loopback connections and for extra security, have winvnc only accept loopback connections.

This method works very well over my Cable modem connection. It is not as easy as the DSM plugin, but it does work.

Good luck,
-John


Update...

Server side - stunnel.conf
cert = stunnel.pem
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
taskbar = no

[vpntnl]
accept = 23456
connect = 5900

Client side - stunnel.conf
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
taskbar = no
client = yes

[vpntnl]
accept = 23456
connect = 69.193.x.y:23456 (use your own IP address here)

---

Now, on the client side run vncviewer to 127.0.0.1:23456. This will get forwarded to 69.193.x.y:23456 (encrypted) & then transparently reconnected to the real VNC port of 5900 (server side). From the stunnel.log file, it looks like the encryption version is AES256-SHA (SSLv3).

[scovel]

Actually the message has nothing to do with plugins at all. What it IS saying is that during the intial connection attempt, when it tried to negotiate the RFB Protocol version, it got an unexpected response. Possible reasons for this are many, INCLUDING, but not limited to, a plugin on one and and none on the other.

FYI, during the initial protocol negotiation one side sends "RFB 3.3" meaning I'm capable of supporting RFB protocols upto version 3.3. The other side responds "RFB 3.3", and then they pick the lowest version they both support. If one side is encrypted and the other is not, you get "RFB 3.3" and then "@%$@%$$" and the negotiation fails with the message in question.

If you are trying to connect to the WRONG IP address, say, a machine that has another service on that port, you get "RFB 3.3" and then "Microsoft Internet Server 6.01" and the negotiation fails with the message in question.

If you do not have the plugins selected, and you can't connect, and you're getting that message, you may not be connecting to the service you think you are...

Sean

[redge]

You have to configure winvnc to allow loopback connections and for extra security, have winvnc only accept loopback connections.

Loopback only fail connection there a bug not fixed since 1.0.0

[garciam25]

jftuga,

i think you might be on to something!!! i think i have the Stunnel thing set up right, because instead of getting the same error message from VNC regarding DSM plugins, i'm getting a "Failed to connect to server" message - which is good news i think! that just means some of my settings are off or i'm not doing something right!

where did you get the number 127.0.0.1 from? i've change the port i'm looking at to another number other than 23456, but i'm not sure what the 127... IP is that you said to connect to, you mean MY IP right? what about all the other junk that stunnel.conf file has in it regarding pop3 and smtp? delete it all?

the MAIN thing is the certificate that needs to be changed from the stunnel.pem one that isn't a real certificate, as the stunnel.conf file says

The default certificate is provided only for testing and should not be used in a production environment

then the help file from stunnel says:

Each SSL enabled daemon needs to present a valid X.509 certificate to the peer. It also needs a private key to decrypt the incoming data. The easiest way to obtain a certificate and a key is to generate them with the free OpenSSL package. You can find more information on certificates generation on pages listed below.

Two things are important when generating certificate-key pairs for stunnel. The private key cannot be encrypted, because the server has no way to obtain the password from the user. To produce an unencrypted key add the -nodes option when running the req command from the OpenSSL kit.

umm, what???? remember, i'm VERY new to all this, i can hold my own, but this is a little much....

on the server side, i need to INSTALL and START the service, correct? on the client side, do i need to have the service installed and started? i've tried a few different combinations, but i can't figure it out... also, which is it about the loopback that i need to have configured - allow loopback AND have VNC only accept loopback, or not like regde just said?

[jftuga]

Mike,

This may explain it better...
http://www.stunnel.org/examples/vnc.html (2nd example)

To create your own pem cert file...
http://www.stunnel.org/faq/certs.html

A *very easy* way to do this, but not recommended...
http://www.stunnel.org/pem/

Also, you can get rid of all of the smtp, pop examples. What I posted was literally my config files -- they are that short.

I would do as redge recommends -- allow loopback connections, but do not check the box that says allow only loopback connections.

Good luck,
-John

[garciam25]

John,

still not working, still giving me the Failed Connection error, though the example on that site is DIFFERENT than the one you are doing - it shows the Accept connections on the client side being the ports, whereas your example shows the stunnel port (the 5900 that VNC uses vs. your 23456).... i think i'm going to start from the beginning here, so you or anyone else can find the problem, because i sure cant:

on my router, i have the following settings, as per the Port Forward site's recommendations (Linksys WRT54GX4):

Application - UltraVNC1
Start - 5900
End - 5900
Protocol - BOTH
IP Address - 192.168.1.101 (my specific computer on my LAN)
Enabled

Application - UltraVNC2
Start - 5800
End - 5800
Protocol - BOTH
IP Address - 192.168.1.101 (my specific computer on my LAN)
Enabled

from there, my settings on the SERVER side (my specific computer on my LAN) from the stunnel.conf file:

cert = stunnel.pem
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
taskbar = no
client = no

[winvnc]
accept = 12582
connect = 5900

then on the CLIENT side (my laptop):

socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
taskbar = no
client = yes
cert = stunnel.pem

[winvnc]
accept = 12582
connect = 70.115.XXX.YYY:12582

NOTE - the cert i'm using is the one that came with the program right now until i can figure out how to get a secure file from someone with a UNIX machine, but right now i'm just using it for testing, and its not working out so hot apparently! also, the 70.155 number is my IP from the cable modem side, before it reaches the router

i have changed the settings on Norton AntiVirus to allow connections on my laptop to and from port 5900, 5800, and my custom 12582 port.... Trojan Horse protection is still on, as i can't figure out how or where to turn it off, and don't want to turn it off either - if i can't use VNC because of this reason, then i just won't use it, that simple....

NO DSM plugins are on the computer, nor are they being detected by VNC at present.... i only have ONE instance of WinVNC.exe being run, as seen by the C+A+D list of processes screen, and my password is CONFIRMED to be less than 8 characters on VNC.... i am allowing loopback connections, but NOT allowing ONLY loopbacks....

need anything else? what am i doing wrong????? i don't think this is the hardest thing i've ever done, hell, setting up uTorrent and all that other mess seemed like much harder directions than this and i figured it out really quickly, whereas this just won't get resolved!

[jftuga]

On the client are you trying to connect (with UVNC) to 127.0.0.1:12582? Also, you need to allow port 12582 through on your router, not port 5900 nor 5800...if the UVNC server is behind the router.

-John

[garciam25]

John,

nope, i hadn't been connecting to the 127.0.0.1 IP address and configuing the port forwarding to allow 12582, but when i try all that, it gives me the classic error about not selecting a DSM plugin!

what is the application name i should be using for the following items in bold:

- the stunnel.conf file, in the part of the file that has the brackets around it, before the accept and connect commands:

[winvnc]
accept = 12582
connect = 5900

- the port forwarding application on my router:

Application - UltraVNC1
Start - 12582
End - 12582
Protocol - BOTH
IP Address - 192.168.1.101 (my specific computer on my LAN)
Enabled

are those right, or might that be causing an issue? also, i've disabled the port forwarding for both 5900 and 5800 as you suggested....

[jftuga]

The [winvnc] -- what's inside the [] does not really matter. Just make sure they are the same in each config file.

On your VNC client, you will connect to 127.0.0.1:12582. Make sure stunnel is listening on port 12582. You can do this by running this command from the cmd prompt:
netstat -an | findstr "LISTEN".
In this list you should see 0.0.0.0:12582.

Your *partial* client stunnel config would look like this:
[winvnc]
accept = 12582
connect = 70.155.x.y:12582

On your router ( I assume UVNC server is behind the router ), you should allow port 12582 TCP through and have it redirected to the IP address that is running UVNC server (aka winvnc.exe).

On the server, run netstat -an | findstr "LISTEN". You should have 2 entries:
0.0.0.0:12582
0.0.0.0:5900
(if you have selected loopback only in the UVNC server settings, this first entry would be 127.0.0.1:12582 Also, I would uncheck loopback only for now).

The *partial* stunnel config for the server would be:
[winvnc]
accept = 12582
connect = 5900


Now, to make sure that you have a tunnel up & running, from the cmd prompt on the client:

telnet 127.0.0.1 12582

If you see "Could not open connection to the host...Connect failed", then you are not configured correctly. If you see "Welcome to Microsoft Telnet Client...Escape Character is 'CTRL+]'", then you are in good shape. Once you are at this point, press ctrl-] and then, at the Telnet> prompt, press q to quit.

Also, make sure DSM is disabled on both the client & server. On the server, in the Admin properties, uncheck the Use: checkbox in the DSM plugin section near the bottom of the window.


Good Luck,
-John

[garciam25]

everything is working exactly how you said it should, from top to bottom.... both client and server are listening on port 12582, telnet works just fine connecting like you said it would, and there are NO DSM plugins installed on the computer, none are being detedted, and i'm STILL getting the error reading protocol version message! i just don't get it, i don't know what i'm doing wrong here....

from this quote:

On your router ( I assume UVNC server is behind the router ), you should allow port 12582 TCP through and have it redirected to the IP address that is running UVNC server (aka winvnc.exe).

you want me to put winvnc.exe in the "Application" field, correct? i did that, allowing both TCP and UDP protocols, and nothing's changed.... what gives?