Thanks but not very clear. Truthfully, I've always been somewhat mystified on this sort of unpnp stuff on firewalls. please explain. I dont' understand what it is trying to do.


port triggers and other firewall settings are usually a non-starter. First, in many case people can't access their modems or firewalls to set these up. (e.g. in a shared facility). Second, it's impossible to set these up remotely the first time! and third, trying to edit these remotely is perilous. you can easily make a change that prevents you from connecting back.

as for port triggers I've never had good luck with those. In the case of VNC or ssh inbound I don't even see how a port trigger would work. There is no outbound to trigger the port. For ichat there are some outbound connections to the status server and I had set these up for ichat's outbound connections you trigger the inbound port ranged and never got the expected inbound ones to work.

It's very clear: NAT routers with NAT-PMP or UPnP enable you to use iChat for screen sharing.

NAT-PMP and UPnP originate at the host and tell the firewall to listen for traffic on a specific port, and when that traffic arrives, forward it to the host. It's a dynamic way of opening ports as needed for specific services at the time they are used. Think of it as automated port forwarding.

Port triggers are a little different. Port triggers are configured at the firewall, and when a host behind the firewall sends outgoing traffic on a specific port, the firewall knows to listen for a response back on another specific port or port range and to forward that traffic back to the originating host.

I see that the article has been changed to attempt to negate my original point, but I want to state that reverse VNC via Vine Server isn't absolutely necessary behind all NAT firewalls, and that includes Apple's own AirPort base stations. iChat works fine through them.

There's nothing hard about configuring a firewall for NAT-PMP/UPnP if it supports it. Port triggering works exactly as I stated above when configured correctly. Both of these things can be done remotely and are hardly perilous if you're competent.