VNC uses 5900+N where N is the display number. Display 0 is on port 5900, display 1 on 5901, and so on. The right port to open depends on how many VNC sessions you plan to run and whether you’re tunneling over SSH.
Table of contents
- The display-number-to-port mapping
- The single-display case
- Tunneling over SSH
- The multi-display case
- What usually breaks
- Firewall rules for VNC
- The VeNCrypt alternative
- FAQ
The display-number-to-port mapping
VNC was designed around the X11 display concept. Display :0 maps to port 5900, display :1 maps to port 5901, display :N maps to port 5900+N. The team that runs more than one VNC session on the same host opens more ports.
The legacy “HTTP base” port is 5800+N for the Java viewer. Modern VNC servers don’t use this; ignore it.
The single-display case
If you only run one VNC session, the right port is 5900. The firewall rule is allow tcp 5900 from <trusted-ip>. The team that opens 5900 to the public internet gets their server brute-forced within hours; the right answer is to tunnel over SSH.
Tunneling over SSH
The right answer for security: SSH tunnel. The local port forwards to the remote VNC port:
ssh -L 5900:localhost:5900 user@hostThen connect the VNC viewer to localhost:5900. The VNC traffic is encrypted by the SSH tunnel; the firewall never sees 5900. The team that uses this pattern does not need to open 5900 on the firewall.
The multi-display case
If you run multiple VNC sessions, the right approach is one of:
- Open 5900 through 5900+N on the firewall, one rule per display.
- Use SSH tunnels with different local ports for each remote display.
- Use a VNC server with a single port and an internal display selector (x11vnc with
-display find, or NoVNC’s web front-end).
The team that opens all 5900-5910 to the public internet is inviting trouble.
What usually breaks
The three pitfalls:
- The port is right but the interface is wrong. The VNC server binds to 0.0.0.0 by default; the team that wants to restrict it to localhost uses
localhostin the VNC config. - The display number is wrong. The VNC client expects display 0 (port 5900) by default; the team that runs the server on display 1 specifies
host:5901in the client. - The firewall is open but the route is blocked. The team that opens 5900 on the host firewall but has a cloud security group that blocks it gets nothing.
Firewall rules for VNC
The right firewall config for a public-facing VNC server:
Default deny, allow by exception.
# iptables
-A INPUT -p tcp --dport 5900 -s <trusted-ip> -j ACCEPT
-A INPUT -p tcp --dport 5900 -j DROPThe team that opens 5900 to the entire internet gets brute-forced within hours. The team that allows only trusted IPs has a VNC server that’s only reachable from the right places.
For the SSH-tunnel case, the firewall doesn’t need a 5900 rule at all. The VNC traffic comes in as SSH on port 22, and the SSH tunnel forwards to localhost:5900 on the server. The team that uses SSH tunnels has a simpler firewall and a more secure VNC setup.
The VeNCrypt alternative
The right tool for encrypted VNC:
VeNCrypt is an extension to the VNC protocol that adds TLS encryption. Servers that support it: TigerVNC, TightVNC (newer versions), RealVNC.
Configuration:
- Generate a server certificate (self-signed or from a CA).
- Configure the VNC server to use the certificate.
- Configure the VNC client to verify the certificate.
The team that uses VeNCrypt has encrypted VNC without the SSH tunnel overhead. The team that doesn’t have VeNCrypt support uses SSH tunnels or moves to a different remote desktop protocol (RDP, NoMachine).
FAQ
What port does VNC use by default?
5900 for display 0, 5901 for display 1, etc. The team that uses vncserver :1 listens on 5901.
Can I run VNC without opening any ports?
Yes, with an SSH tunnel. The VNC traffic goes through the SSH connection; no firewall port needs to be open.
Is VNC encrypted?
No, the base VNC protocol is plaintext. The team that wants encryption uses SSH tunneling or VeNCrypt (x509 certs).
What’s the difference between VNC and RDP?
VNC is platform-agnostic, lower-performance, and unencrypted by default. RDP is Windows- native, higher-performance, and encrypted by default. The team that uses VNC on Windows is using TightVNC or TigerVNC, not the native RDP.
What’s the difference between VNC and TeamViewer?
VNC is open-source, cross-platform, and unencrypted by default. TeamViewer is proprietary, has its own protocol, and is encrypted by default. The team that uses VNC for occasional remote support is fine; the team that uses VNC for production remote access uses VeNCrypt or SSH tunneling.
Can I run VNC over the internet?
Yes, but use an SSH tunnel. The team that opens VNC to the public internet has a brute-force target within hours. The team that tunnels over SSH has a VNC server that looks like SSH traffic from the outside.
What port does noVNC use?
noVNC uses port 6080 by default (or 80/443 if proxied through a web server). The team that uses noVNC has a VNC client that runs in the browser, no client software needed.
If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.
Useful related references: