{"id":8268,"date":"2021-03-17T23:40:39","date_gmt":"2021-03-17T20:40:39","guid":{"rendered":"https:\/\/kifarunix.com\/?p=8268"},"modified":"2024-03-19T18:50:44","modified_gmt":"2024-03-19T15:50:44","slug":"control-nomachine-ports-on-firewall","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/control-nomachine-ports-on-firewall\/","title":{"rendered":"Control NoMachine Ports on Firewall"},"content":{"rendered":"\n

In this blog post, you will learn how to control NoMachine<\/a> ports on Firewall. If you have been using NoMachine, you might have realized that its default NX server port 4000\/tcp is listening on all system interfaces and is accessible to anyone even if firewall is running on the system. This poses a risk whereby anyone can connect to the service remotely and hence, call for a need to allow only specific trusted IPs to access the port.<\/p>\n\n\n\n

Let us learn how you can control this situation to only allow the port to be accessible from specific system IPs.<\/p>\n\n\n\n

Controlling NoMachine Ports using System Firewall<\/h2>\n\n\n\n

As stated above, the NoMachine server port 4000\/tcp is accessible even if firewall is running.<\/p>\n\n\n\n

In my test system, UFW is running and no port is opened on the firewall;<\/p>\n\n\n\n

ufw status<\/code><\/pre>\n\n\n\n
Status: active<\/code><\/pre>\n\n\n\n
To confirm that UFW is running and blocking, we can try to test the connection to SSH port from a different server;<\/p>\n\n\n\n
Confirm that the ssh service is running on a remote desktop system running NoMachine server;<\/p>\n\n\n\n
netstat -altnp | grep 22<\/code><\/pre>\n\n\n\n
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      571\/sshd: \/usr\/sbin \ntcp6       0      0 :::22                   :::*                    LISTEN      571\/sshd: \/usr\/sbin<\/code><\/pre>\n\n\n\n
Now, from one of the external systems, let us try to connect to SSH port to verify that UFW is running and blocking connections;<\/p>\n\n\n\n
nc -vn 192.168.57.26 22<\/code><\/pre>\n\n\n\n
Sample output showing the port connections is blocked by firewall;<\/p>\n\n\n\n
(UNKNOWN) [192.168.57.26] 22 (ssh) : Connection timed out<\/code><\/pre>\n\n\n\n
Now, try to test the connection to NoMachine server port;<\/p>\n\n\n\n
nc -vnz 192.168.57.26 4000<\/code><\/pre>\n\n\n\n
(UNKNOWN) [192.168.57.26] 4000 (?) open<\/code><\/pre>\n\n\n\n
Try telnet;<\/p>\n\n\n\n
telnet 192.168.57.26 4000<\/code><\/pre>\n\n\n\n
Trying 192.168.57.26...\nConnected to 192.168.57.26.\nEscape character is '^]'.\n<\/code><\/pre>\n\n\n\n
Using System Firewall to Control NoMachine Ports<\/h3>\n\n\n\n
According the NoMachine configuration file, usually, BaseDirectory\/etc\/server.cfg<\/strong><\/code>, the NoMachine server automatically configures the firewall for all of its configured services.<\/p>\n\n\n\n
The NoMachine configuration option for controlling the firewalling of its configured servers is EnableFirewallConfiguration<\/strong><\/code>.<\/p>\n\n\n\n
This option can take two values;<\/p>\n\n\n\n