Impossible to connect over VPN

[Slide21]

Hi, since several version (1.2.0.5 at least) I can't connect to PC in my enterprise over a VPN connexion.

Old PC (In XP) have the 1.0.2 version and wok's correctly.

I've check this last version 1.2.1.0 and the issue stil present.

For test, i've instlled the 1.2.1.0 on an XP PC and the problem appear... So I think there is a problem (perhaps configuration) between 1.0.2 and 1.2.0.5 at least... and sill in 1.2.1.0 version...

can you help me to solved this...

thank's a lot

[Rudi De Vos]

When you make a vpn connection, your pc get a new ip address of the enterprise environment.

Where is the server running ? on the vpn pc or the interprise network.
Who is connecting to who ? viewer connect to server ?

Is the server started/viewer started after the vpn connection ?

[Slide21]

Hi,

Yes the server is enterprise PC and Viewer is my PC at home (test from several place)

I connect my PC to VPN, obtain a new IP , right, and try to connect to enterprise PC where server VNC run (as service) I've the logon screen (AD connection), the check of user/password is OK, the connexion begin, I see a little of the screen and crash (my viewer is configure to make retry every 3 seconds) retry, crach, retry crach again and again but never connect completely. The RDP connexion work's perfectly.

In the enterprise from another PC connexion is OK.

From my PC over VPN, connexion to an XP PC whith server 1.0.2 is OK, but XP with server 1.2.1.O crah like the Windows 7 (same with the 1.2.0.5 version)

Vnc Server is already running (as service) so the VPN connexion start after the VNC server.

I've trying a lot of configuration of VNC server but nothing.

If you want other test, I will be able to make it because a lot of our client need connect to our PC.

Thank's a lot.

PS : I've reply to another post few weeks ago in which the problem could be somewhat the same. : https://forum.ultravnc.net/viewtopic.php?f=3&t=31531

[Rudi De Vos]

The server is running on the corporate site, this has a fix ip , it's the viewer PC that get a vpn ip.
Between 102 and 121 almost 80% of the code changed ... hard to check the changes.

Does it crash or disconnect...
The viewer keeps working, he reconnect...it would be interested to see if the server crash or just disconnect.
Using the service it's hard to tell, because the service restart winvnc in case of any error.

As test,
1)you could run winvnc manual.
If you have RDP
net stop uvnc_service
start winvnc.exe in a RDP session
keep the session open, don't minimize to keep the rdp display active
connect to the the vnc server
Running as application, you should see if the server crash or just disconnect

2) Use a fixed encoder ( viewer option)
I just discovered a crash in jpeg lib select zrle or hextile, something that doesn't use jpeg.

3) Replace winvnc.exe by the w2k version.
There are reports that on some AMD cpu's the newest MS compilers use sse functions taht doesn't exist.
I would expect that it crash from start...but you never know.
If you download the bin zip, you have all exe in a single zip, easier to test.
If you use a plugin, keep in mind that exe and plugin need to have the same arch ( 32/64) else plugin fail to load.

[Slide21]

I've test today your different solution :

1) With vnc server running as application, no crash but diconnect. I have the allow display windows, click on Accept then disconnect appear and another Allow windows appear (because my client try few times)

That's same in service mode. There is effectively no crash but just disconnect, message on viewer is "connexion dropped".

2) Try fixed encoder, zrle, hexfile and all other one, same issue. If I chose less color I can see a little of client screen before disconnect with some encoder.

3) Trying but same issue..


But i found a solution... If i use the encryption pluggin SecureVNVPlugin64.dsm (besause both of my server and client are in 64bits) the connexion will work... with default config.

Have I to always use DSM plugin for VPN connexion ? How can I do if my viewer is installed on 32bits client ? I can use the DSM 64bit ?

Thank's

[Rudi De Vos]

server/viewer 64bit require SecureVNVPlugin64.dsm
server/viewer 32 bit require SecureVNVPlugin.dsm

A plugin is like a dll, you can only load 64bit dll's with a 64bit application and a 32bit dll with a 32bit app.

You can mix viewer(64)+plugin (64) with a server(32) + plugin 32 or a viewer32+plugin32 with a server64+plugin64.

[Slide21]

OK but DSM plugin is a require for connexion over VPN ? with old version we don't have plugin...

you know that's can be a bug or an issue with our VPN ?

[Rudi De Vos]

In the old days there was only a 32bit server/viewer with a 32bit encryption plugin.
Now you can have 32 or 64 bit, You only need to make sure you install the correct plugin for your arch.
If you upgrade a 32b server with a 64bit, and forget to upgrade the plugin, the plugin fail with an integrity check error.

For a connection over a VPN the internet data is already encrypted via the VPN software. Using the encryption plugin
it's 2 encryptions...it depend on the customer and the savety of his own network.

VPN
YOUR-PC <->encrypt<->enterpise VPN server <-> unencrypted enterprise LAN<-> vnc server
VPN+plugin
YOUR-PC <-> dual encryption->enterpise VPN server <->plugin encryption <->vnc server

[danbol45]

for some reason, my Texas network does not like connecting when you have both hosts running any version higher than 1.0.8. so for example. I have version 1.2.1 on TXSQL02 and ver. 1.0.8 on my computer and everything works. As soon as I change the versions I either cannot get CTL+ALT+DEL to work or it drops the connection.

So if I put version 1.0.8 on the server and any version on my computer. I can connect but CTL+ALT+DEL does not work.

If I have version 1.2.1 on the server and I have version 1.2.1 on my computer I cannot stay connected. The connection drops.

If I have version 1.0.8 installed on both my computer and the server. CTL+ALT+DEL does not work. But I can connect.

This is driving me crazy and I have some thumb sucking Programmers/developers here that refuse to "downgrade" to be able to do their work and blaming me for them not being able to do their jobs, even though I came up with a work around. They want to use 1.2.1. on both their local machines and the server.

[Rudi De Vos]

There is only one file that differ in the versions:
winvnc.exe and vncviewer.exe
You can easy switch by just replacing this exe, no need to reinstall.

*Best is to have same version viewer/server on both sites
But, Vnc use rfb and this allow to use different versions.
Uvnc server works with a tight or realvnc viewer ( some parts get disabled)
You can also use an older viewer, like with other flavors, some functions get disabled.

+Do you use encryption plugins ?
+OS server

I cannot stay connected. The connection drops.

Do you get anything on the screen
Activate server log... without any logging it's hard to tell what happen.

Possible a VPN connection has a fluctuating bandwidth, try using fix encoders to avoid the auto encoder switching.
( viewer option)

[danbol45]

No encryption plug ins and I am using Windows 10 and server 2012. Nothing appears on the screen. It just drops and tries to reconnect.

[Rudi De Vos]

We do test between USA(server) and Belgium(viewer) but without VPN and this is stable, so distance can't be the cause.

The VPN is manupilating the network packet in a way it cause this, but way with the new versions and not with the old.

Does a fix encoder (viewer option) also disconnect ?
If you have multiple servers on the VPN site, does the viewer disconnect with all of them ?
Is it some free VPN software so we can repeat it in lab...but possible it also depend on the network himself.

[danbol45]

It happens only when both sides are higher then ver 1.0.8. It works if one side is 1.2.1 and the other is 1.0.8. I have tried setting the encoder manually and that does not work.I have been able to replicate the issue on multiple computers. No, we are using Sonicwall Firewalls

[Rudi De Vos]

*1.08 use rfb proto 3.3 while 1.2 use rfb 3.8

When a 1.08 viewer/server is used, the server/viewer goes in rfb3.3 mode.

It looks like the 3.8 connection protocol get broken with Sonicwall..


JUst wondering if the Sonicwall has an intrusion detection system that read the actual data.
Accepting 3.3 and refusing 3.8... ptotocol. I remember something simular with some other firewall.

[Rudi De Vos]

If you have access to the winvnc.exe it would be handy if you can activate the logging and see what the server does on disconnect.

Perhaps you can start vncviewer with a log option
vncviewer.exe -console
Open a console window for log output.
or
vncviewer.exe -logfile mylog.txt
Log to the file specified by filename.

You never knwo if something relevant is logged.

[Rudi De Vos]

Have been testing with a free vpn.
SoftEther vpn.

Uvnc works, but is slow.
I kept it online for more then an hour and no crash or disconnect on server/viewer site.

[danbol45]

We are using Sonicwall NAS 3500. I am looking at the Intrusion Protection settings to see if that is blocking anything.

[Rudi De Vos]

Please test this server, it seems to fix related issue's

WIN7>= 32 and 64 bit

http://www.uvnc.eu/download/1211/uvnc_1 ... _test1.zip

better use test 2, test1 could lock on slow vpn connection.

http://www.uvnc.eu/download/1211/uvnc_1 ... _test2.zip