The secondary tcp connection from server to client is being blocked by a firewall or IP filter. You must allow traffic originating from server:any to client:512-1024. Keep in mind that rsh is considered VERY INSECURE and not to be used outside the confines of a completely secure network.