Fortigate SSLVPN 无法连接内网 VNC 服务器

创建于2025-04-12

2025年4月12日更新

预计阅读7分钟

全文约1.5k字

我的内网有个服务器开放了VNC服务，本来是打算通过VNC服务远程访问内网的桌面，但是VNC的端口一经开放就“好评如潮”，实属难绷。

后来想到我内网在用的网关具备SSLVPN功能，于是打算将SSLVPN作为“关口”控制访问内网，但是Fortigate SSLVPN的VNC访问功能一直报错连接关闭，今天小小的研究了一下并最终解决了这个问题。

错误分析

主机侧

我内网VNC服务器安装的是TigerVNC Server，使用自己写的Systemd服务配置文件守护运行，详见在 armbian 上安装 xfce 和 VNC 做远程桌面，找到日志文件，看了一下没有什么有用新的信息，基本就是连接的时候连接端主动断开了。

我本地使用RealVNC Viewer测试后连接一切正常，只有Fortigate SSLVPN的VNC会断联，那么初步判断问题出在Fortigate上。

网关侧

Fortigate防火墙具备相对强大的调试功能，通过开启相关功能的调试选项，可以在相对底层的环节查看到日志。

首先先开启SSLVPN的调试日志：

CanbinTest-50E # diagnose debug application sslvpn -1
Debug messages will be on for 30 minutes.

CanbinTest-50E # diagnose debug enable

然后来到SSLVPN Portal上创建VNC连接，不出意外报错了连接失败，这会其实我还在想会不会是浏览器问题，Fortigate的架构比较老浏览器内核太新导致什么东西没加载出来。

通过检查Console中的日志确实也发现了一些熟悉的东西：guacamole，看来Fortigate使用网页连接VNC使用的是Guacamole的后端。

于是尝试开启Guacd的debug日志：

1 2	CanbinTest-50E # diagnose debug application guacd -1 Debug messages will be on for 27 minutes.

然后再次连接，果不其然发现了一些蛛丝马迹：

guacd[7524]: INFO:      Creating new client for protocol "vnc"
guacd[7524]: INFO:      Set process vfid 0
[144:root:117]ws_guacd_expecting_instruction:1019 get pid: 7524
guacd[7524]: INFO:      Cursor rendering: local
guacd[7524]: DEBUG:     Parameter "swap-red-blue" omitted. Using default value of 0.
guacd[7524]: DEBUG:     Parameter "read-only" omitted. Using default value of 0.
guacd[7524]: DEBUG:     Parameter "color-depth" omitted. Using default value of 0.
guacd[7524]: DEBUG:     Parameter "dest-port" omitted. Using default value of 0.
guacd[7524]: DEBUG:     Parameter "encodings" omitted. Using default value of "zrle ultra copyrect hextile zlib corre rre raw".
guacd[7524]: DEBUG:     Parameter "autoretry" omitted. Using default value of 0.
guacd[7524]: DEBUG:     Parameter "reverse-connect" omitted. Using default value of 0.
guacd[7524]: DEBUG:     Parameter "listen-timeout" omitted. Using default value of 5000.
guacd[7524]: DEBUG:     Parameter "recording-name" omitted. Using default value of "recording".
guacd[7524]: DEBUG:     Parameter "create-recording-path" omitted. Using default value of 0.
guacd[7524]: INFO:      Got client IP address: (null)
guacd[7524]: INFO:      Got interface name for sdwan: (null)
guacd[7524]: INFO:      User "@54bed74b-e8b8-4cef-9c80-f07e43e5a812" joined connection "$c97e001b-81c0-4ca8-ba35-0f361e27e49f" (1 users now present)
guacd[7524]: DEBUG:     create input thread
guacd[7524]: DEBUG:     input thread running
guacd[7524]: INFO:      VNC server supports protocol version 3.8 (viewer 3.8)
guacd[7524]: INFO:      We have 2 security types to read
guacd[7524]: INFO:      0) Received security type 19
guacd[7524]: INFO:      Selecting security type 19 (0/2 in the list)
guacd[7524]: INFO:      1) Received security type 2
guacd[7524]: INFO:      Selected Security Scheme 19
guacd[7524]: INFO:      OpenSSL version OpenSSL 1.1.1t  7 Feb 2023 initialized.
guacd[7524]: INFO:      Got VeNCrypt version 0.2 from server.
guacd[7524]: INFO:      We have 2 security types to read
guacd[7524]: INFO:      0) Received security type 2
guacd[7524]: INFO:      1) Received security type 258
guacd[7524]: INFO:      Selecting security type 258 (1/2 in the list)

可见Guacd其实是成功连接了VNC Server的，但是在向服务器质询加密方式时，VNC Server提供了 VeNCrypt 安全协议（type 2和type 258），随后Guacd选择了258作为安全协议，但是 FortiGate 内置的 guacd 并不支持 VeNCrypt 的加密方式，因此连接中断。

解决问题

到这里问题其实就很明确了，VNC Server提供的安全协议在Fortigate这边并不受支持，那么禁用可行吗？

VNC禁用加密

打开主机侧VNC Server Systemd配置文件/etc/systemd/system/vncserver@.service，找到ExecStart行然后添加-SecurityTypes=none：

1	ExecStart=/usr/bin/vncserver -depth 24 -geometry 1400x900 :%i -localhost no -SecurityTypes=none

然后重启VNC Server：

1	systemctl daemon-reload && systemctl status vncserver@1

不出意外出现了报错：

root@cabintester2504:~/.vnc# systemctl status vncserver@1
● vncserver@1.service - Start TightVNC server at startup
     Loaded: loaded (/etc/systemd/system/vncserver@.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Sat 2025-04-12 18:14:22 CST; 2min 21s ago
    Process: 2433448 ExecStartPre=/usr/bin/vncserver -kill :1 (code=exited, status=1/FAILURE)
    Process: 2433526 ExecStart=/usr/bin/vncserver -depth 24 -geometry 1400x900 :1 -localhost no -SecurityTypes=None (co>
   Main PID: 2433526 (code=exited, status=255/EXCEPTION)
        CPU: 1.072s

Apr 12 18:14:21 cabintester2504 systemd[1]: Starting Start TightVNC server at startup...
Apr 12 18:14:22 cabintester2504 vncserver[2433448]: vncserver: No matching VNC server running for this user!
Apr 12 18:14:22 cabintester2504 systemd[1]: Started Start TightVNC server at startup.
Apr 12 18:14:22 cabintester2504 vncserver[2433526]: vncserver: YOU ARE TRYING TO EXPOSE A VNC SERVER WITHOUT ANY
Apr 12 18:14:22 cabintester2504 vncserver[2433526]: AUTHENTICATION TO THE WHOLE INTERNET! I AM REFUSING TO COOPERATE!
Apr 12 18:14:22 cabintester2504 vncserver[2433526]: If you really want to do that, add the --I-KNOW-THIS-IS-INSECURE option!
Apr 12 18:14:22 cabintester2504 systemd[1]: vncserver@1.service: Main process exited, code=exited, status=255/EXCEPTION
Apr 12 18:14:22 cabintester2504 systemd[1]: vncserver@1.service: Failed with result 'exit-code'.
Apr 12 18:14:22 cabintester2504 systemd[1]: vncserver@1.service: Consumed 1.072s CPU time.