This enables the internal XDMCP-equipped (UNIX or ReflectionX) hosts to access external XDMCP-equipped XWindows servers. User Datagram Protocol (UDP)/177-based XDMCP negotiates a TCP-based XWindows session, and subsequent TCP back connections are permitted.
Because the source port(s) of the return traffic is unknown, the src_port field must be specified as 0 (wildcard). The destination port, dest_port, is typically 6000, the well-known XServer port. The dest_port must be 6000 + n, where n represents the local display number. Issue the setenv DISPLAY hostname:displaynumber.screennumber UNIX command to change this value.
The established command is necessary because many TCP connections are generated based on user interaction, and the source port for these connections is unknown. Only the destination port is static. The PIX Firewall does XDMCP fixups transparently. No configuration is required, but the established command is necessary to accommodate the TCP sessions. Using applications like this through the PIX can open up security holes.