How to set up VNC Proxy
- 1. Prerequisites
- 2. Add an interface to the VNC Proxy host for each hypervisor
- 3. Copy the compiled VNC Proxy binary file to /usr/sbin and change file permissions to 544
- 4. Configure /etc/vncproxyd.conf
- 5. Configure firewall rules to allow VNC connections from the DMZ to the hypervisor host
- 6. Set Abiquo Configuration Properties if necessary
- 7. In the Abiquo GUI change the Service IP to the DMZ host IP address
- 8. Start the VNC service with the command /usr/sbin/vncproxyd
|Work in Progress|
We are currently working to improve this documentation
This guide assumes the reader is familiar with VNC configuration on the Abiquo Platform as described in the Abiquo Administrator's Guide - Configuring Remote Access to Virtual Machines, the configuration of proxy servers and the configuration of their firewall.
This guide will show you how to set up a VNC proxy to allow the Abiquo user to open a console window on their virtual machines from within the browser where they are running the Abiquo client, while hiding the public IP addresses of the hypervisors from outside networks.
VNC connections from the Abiquo client GUI to virtual machines through the eye icon will connect to the VNC proxy, which runs on a host in the DMZ. These connections will be redirected by the VNC proxy to the hypervisor on which the virtual machines are running. Thus there is no direct connection to the hypervisor.
On the proxy host you will need to add one NIC (virtual or physical) for each hypervisor. Each connection to a virtual machine goes to a different port on the hypervisor, which is running a VNC server.
Before configuring the VNC proxy, you should read the Abiquo Documentation on Configuring Remote Access to Virtual Machines.
You will need to run the VNC proxy on a host in your DMZ, and this would typically be the same host as the DMZ X Server.
Enterprise customers can download the vncproxy.zip file from the enterprise directory of the Abiquo Enterprise downloads website. This archive contains the vncproxyd binary file and the vncproxyd.conf file. The binary was compiled on Abiquo 1.8 CentOS build for 32-bit/64-bit compatibility and should work on most machines running Linux.
2. Add an interface to the VNC Proxy host for each hypervisor
Add a physical or virtual interface for each hypervisor.
2.1. Example of how add a virtual interface
Use the ifconfig command with the following format:
Here, x.x.x.x is the new IP address and y.y.y.y is the netmask. The virtual interface number is nnn. So, for example, if the address of your proxy host is 10.1.1.10 and the netmask is 255.255.255.0 and the virtual interface number is 1000, you would type the following:
Copy /etc/sysconfig/network-scripts/ifcfg-eth0 and give it the name of the newly created interface. Following the example above, you would type this command:
Edit the file to suit your network. Continuing with the above example, you would replace the contents of the file with the following text. Replace IPADDR with your proxy machine's IP address.
Create one file for each of the virtual interfaces you created.
3. Copy the compiled VNC Proxy binary file to /usr/sbin and change file permissions to 544
For example, while logged in as root:
The binary file available from Abiquo is compiled for CentOS/Redhat 5.x 64-bit.
Note that permissions 544 are "read-execute" for root user and "read" for all other users.
4. Configure /etc/vncproxyd.conf
4.1. Create /etc/vncproxyd.conf and set permissions to 644
Note that permissions 644 are "read-write" for root user and "read" for all other users.
4.2. Edit /etc/vncproxyd.conf
For each hypervisor, add a row for each port (virtual machine) with the following:
Here is a sample vncproxyd.conf file.
- Configure the log with the line:
- The sample /etc/vncproxyd.conf is for 2 hypervisors
- Each hypervisor has 15 ports open for 15 virtual machines, so there are 15 lines for each hypervisor (one for each port)
- The format of each row is: ProxyIP ProxyPort HypervisorIP HypervisorPort
The fields in each row are:
- ProxyIP: The IP addresses of the virtual interfaces on the proxy server for these hypervisors are 10.1.1.10 and 10.1.1.11. These interfaces should be accessible to the Internet for VNC (TCP) connections from the Abiquo client. In Abiquo, this is the "Service IP" for the hypervisor.
- ProxyPort: The ports open on the virtual interfaces on the proxy server for these hypervisors are 5900 to 5915. These ports should be accessible to the Internet for VNC (TCP) connections from the Abiquo client.
- HypervisorIP: The IP addresses of the hypervisors on the internal network are 192.168.1.35 and 192.168.1.36. The proxy server in the DMZ should be able to connect to the hypervisors with TCP on these addresses through the firewall
- HypervisorPort: The ports for VNC connections on the hypervisors are 5900 to 5915. The proxy server in the DMZ should be able to connect to the hypervisors with TCP on these ports through the firewall
Note on Port Numbers:
- The ports used for the proxy and the hypervisor are the same: they start from 5900 and go to 5915. If possible, map the proxy ports to the ports with the same number on the hypervisor to avoid confusion (i.e. proxy 5900 to hypervisor 5900). Note that you need one port on the hypervisor for each virtual machine that will require a VNC connection. See Configuring Remote Access to Virtual Machines
5. Configure firewall rules to allow VNC connections from the DMZ to the hypervisor host
This step will depend on your firewall configuration. In general, you should allow VNC connections from the DMZ to the hypervisor IPs and ports. Following the above example, you would allow VNC (TCP) connections to the hypervisor hosts with IP addresses 192.168.1.35 and 192.168.1.36 on ports 5900 to 5915.
6. Set Abiquo Configuration Properties if necessary
To use a different port range from the default (5900-65534) set the abiquo.vncport.min and .max in Abiquo Configuration Properties. Check the recommendations for your hypervisor. See Configuring Remote Access to Virtual Machines.
7. In the Abiquo GUI change the Service IP to the DMZ host IP address
- In Infrastructure View, locate the hypervisor, and click the configuration button to modify its settings.
- Change the Service IP setting to the corresponding IP address in the /etc/vncproxyd.conf file and click Accept.
Following on with the example above, the first hypervisor IP management address is 192.168.1.35 and the Service IP would be 10.1.1.10, which is the IP of the proxy server.
8. Start the VNC service with the command /usr/sbin/vncproxyd
If the VNC configuration file needs to be modified (/etc/vncproxyd.conf) you must restart the VNC service with the following command:
Any VNC console connections from the Abiquo client GUI to virtual machines by clicking the eye icon will now go to the DMZ host IP and the redirection will send the request to the hypervisor.