wtheone

Q: Problem connecting from my home to work to different stations!

Alright, here is the problem..


i have 5 workstations all iMacs and the router is Dlink DIR-632 model. I have one workstation where i have installed Apple Remote Desktop and Port forwarded to that workstation.

 

The problem is, if i want to just connect to a specific workstation it seems that no matter what i do, i have to go through that one and from there connect to others... but it becomes extremely slow! Dont know what to do anymore!

 

Dont know if this is relevant but my working server is a DELL with Windows Server 2012 on it...

 

Any suggestions?

 

Thanks

 

William!

MacBook Pro, OS X El Capitan (10.11.5)

Posted on Jul 11, 2016 9:25 AM

Close

Q: Problem connecting from my home to work to different stations!

  • All replies
  • Helpful answers

  • by MrHoffman,

    MrHoffman MrHoffman Jul 13, 2016 11:39 AM in response to wtheone
    Level 6 (15,612 points)
    Mac OS X
    Jul 13, 2016 11:39 AM in response to wtheone

    Port forwarding sends everything inbound at the firewall to the specified system.

     

    • Either acquire a firewall with an embedded VPN server within the firewall box and configure and VPN into that (and which will provide you with a virtual private network connection roughly akin to being a computer locally and directly connected to the target network, and from which you can then screen share into the target computer),
    • ...or use the command line and ssh for remote access as that tends to be rather less heavyweight than using screen sharing,
    • ...or see if your screen sharing client allows you to specify the target port and then configure your present firewall to forward that port at the "correct" port on the other target box (using the inbound port to select the target system),
    • ...or expect to have to VPN into or to screen share into the target system; into whatever box your current firewall is configured to port-forward into (your present configuration).

     

    Screen sharing is very commonly probed for weak passwords — I'd expect to have your users and passwords on whichever box is running a screen sharing daemon — each of your target boxes for screen sharing — checked a couple of times an hour, and quite probably more often, and quite possibly some dictionary attacks.  Either use solid passwords, or switch to a VPN and good passwords, or expect problems...

  • by wtheone,

    wtheone wtheone Jul 13, 2016 2:13 PM in response to MrHoffman
    Level 1 (8 points)
    Servers Enterprise
    Jul 13, 2016 2:13 PM in response to MrHoffman

    Your definitely an expert on the subject and to be honest you lost me on those points. First of all i never used the SSH line to access anything. The way you explain me, i have to ask a network expert to set it up for me! I never had problems before i installed iMacs as workstations, i just port forwarding and every employee was able to connect to their respective workstation places. I guess Mac/Windows/Routing its very different...

     

    I dont know if its possible for you to elaborate more in simpler ways, may examples to explain what you want to say but if you cant, i will just ask a network expert to come to workplace and install whatever its needed!

     

    I thank you very much for your answers

     

    William!

  • by MrHoffman,

    MrHoffman MrHoffman Jul 13, 2016 2:50 PM in response to wtheone
    Level 6 (15,612 points)
    Mac OS X
    Jul 13, 2016 2:50 PM in response to wtheone

    You presently have port forwarding configured.  Port forwarding maps connections incoming from the internet to your public IP address to a private IP address on your internal network, and can optionally also map a public port to a different port on the system on your internal network.

     

    I'd hope that everything connecting into this network isn't getting port-forwarded to that one computer, as that'll just let the remote folks pound on all the open ports on the internal system.   But I digress.

     

    Port forwarding gets you from the public IP to the private IP on the private network.

     

    Port forwarding alone does not give you the choice of which private IP to connect to; which host. 

     

    This means that a remote connection to your public address gets to one computer.

     

    There are ways around that limitation.

     

    A virtual private network is a common mechanism for establishing remote access.   That's a secure, authenticated, encrypted connection from a remote computer on the internet to either your gateway-firewall-box — if your firewall contains a VPN server subsystem — or to a VPN server running on an internal computer.   In the latter case here, you have to configure the gateway-firewall-router box for port forwarding for the VPN-related ports and protocols.   With either of these VPN approaches, the remote client computer gets direct local access to your private network, so screen sharing requests — operating over the VPN connection — can specify any of the local hosts on the private network.   I might suspect this was what you were using with remote access to Microsoft Windows in that other network you've referred to, but — without details — I don't know that for certain.   Setting up a VPN can be a little fussy, and you'll need to configure and maintain a VPN server and the necessary port (and protocol) forwarding at the gateway-firewall-router box.

     

    The other option is to set up different port mapping, so your screen sharing client can specify the port, and the port — at the gateway-firewall-router box, due to its internal configuration — uses the port to select the target IP address and target IP port on the internal network.   This is a little more hack-ish, but it works.   It's only as secure as the password and the network traffic is unencrypted, and — unlike a VPN — you'll have folks poking directly at the internal servers, rather than poking at the VPN server.

     

    I haven't looked at the capabilities and configuration requirements and security details of the gateway-firewall-router box you're presently using; at the specs for that D-Link DIR-632 box.

     

    macOS (OS X) is no different than any other system operating on an IP network.   If you didn't need to connect through a specific host for the other systems in that other network, then that IP network configuration can very likely be extended or can be replicated for use with these macOS systems.

     

    FWIW, this is generic discussion, and not specific to Apple Remote Desktop — that product is a very nice tool for sharing screens and for pushing out commands, but it's an IP application and subject to the IP network configuration and whatever port forwarding or VPN connections are in use.   The integrated screen sharing client and server present in macOS would work the same here, and would have the same limitations around the gateway-router-firewall box, port forwarding and such.   Other network applications would work basically the same here, too.    Same for ssh too, though that's only an option for folks familiar with the command line.   And this is also particularly different than what would be involved with configuring Windows, Linux, BSD or most any other IP-network-connected computer, too.

     

    TL;DR: It'll be faster for you to have somebody configure and secure this network for you, and set you up with secure access on the local and remote client boxes via VPN, unless you want to learn more about configuring and maintaining IP networking, gateway-firewall-router boxes, port forwarding and related topics.  If the latter is of interest, topics in IP networking and routing will be of interest, though I don't have any immediate pointers to books or videos or such on that topic.