Aaron: March 2009 Archives

I occasionally need to get access to my Mac remotely, but it's hiding behind a firewall. To get in through the firewall, I just need to use an SSH port forward command, like this:

ssh serverexternalip -L 1202:workstationinternalip:5900

For those of you not familiar with SSH port forwarding, this command connects to my server on its publicly accessible IP (serverexternalip), and then opens the local port 1202 and connects it to the remote host workstationinternalip on port 5900.

Port 5900 is the port Apple uses for its screen sharing application.

After these steps, I can open the Screen Sharing application and connect to localhost:1202, which transparently connects to the remote workstation through the SSH tunnel.

Obviously, this requires that the SSH session remain open as long as you're working in Screen Sharing.

So I don't forget. On Leopard, there's a VPN setting called "Send all traffic over VPN connection." In theory, unchecking this box will make only connections to VPN-related IP addresses go over the VPN. This doesn't always work. The reason was explained by "Frank" on a comment to this post:

On Leopard there is a checkbox which enables or disables setting of the default route via the VPN. It is in the advanced settings and called something like "Send all traffic through the VPN".

HOWEVER, this only works if the order of the network configurations ("Ethernet", "AirPort", "Firewire", ...) is so that your VPN comes AFTER the interface you're connected to the internet. You can change the order by clicking on the little cog icon next to the +/- icons.

If your VPN comes before the Ethernet or AirPort then the default route will always be set to the VPN regardless of whether you ticked that little checkbox.

:) But wait - there is more.

For each VPN connection you can configure DNS servers. Those are only configured in the /etc/resolv.conf when the VPN connection is sorted above the Ethernet and not below.

So the net result is: You can have VPN with properly configured DNS servers but the default route will always be the VPN

OR

you have the VPN without the default route via the VPN but also no DNS.

This makes perfect sense... but it's not entirely intuitive in the OSX dialog.

By the way, if you happen to still be on Tiger. The above-referenced post itself provides the script-centric method to get the same effect on Tiger.

Who's this guy?

Aaron Longwell is Chief Web Craftsman at New Media Logic Corporation in Coeur d' Alene, Idaho. As a professional software developer for 12 years and a student of public policy, he occasionally has interesting things to say about software, technology, culture and politics.

Subscribe to feed Subscribe to my RSS Feed

  • View Aaron Longwell's profile on LinkedIn
  • Recommend Me