Port 5900 VNC · TCP

What runs on port 5900

VNC: remote framebuffer, the universal remote desktop for Linux, macOS screen sharing (which is VNC underneath) and servers' out-of-band consoles. The classic RFB protocol has an 8-character password limit and no encryption; most implementations now add TLS, but the thousands of VNC servers with no password on Shodan are real. Each display adds one: 5901 is display :1.

Software that uses it: TigerVNC, TightVNC, RealVNC, x11vnc · macOS Screen Sharing · noVNC (web) · Proxmox/libvirt consoles · KVM-over-IP cards

Should port 5900 be open?

Disable it. This is a legacy or insecure protocol. The recommendation is not to firewall it but to turn the service off and use the modern replacement.

• Tunnel it over SSH (ssh -L 5901:localhost:5901 host) or use a VPN; never forward it directly.
• ssvncviewer and vncviewer -SecurityTypes show what the server offers.

Check port 5900

# on the host: is anything listening, and which process?
ss -ltnp 'sport = :5900'
sudo lsof -i :5900

# from another machine: is it reachable?
nc -zv host 5900
nmap -p 5900 host
curl -v telnet://host:5900      # raw TCP connect test, Ctrl-C to leave

A port that answers from the internet when it should not is the finding; nmap from a machine outside your network (or a VPS) is the honest test, because scans from inside the LAN pass the firewall you are trying to verify.

Allow or block port 5900

# ufw (Ubuntu/Debian)
sudo ufw allow from 10.0.0.0/8 to any port 5900 proto tcp
sudo ufw deny 5900/tcp

# nftables
nft add rule inet filter input ip saddr 10.0.0.0/8 tcp dport 5900 accept
nft add rule inet filter input tcp dport 5900 drop

# iptables (legacy)
iptables -A INPUT -p tcp --dport 5900 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 5900 -j DROP

# firewalld
sudo firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 port port=5900 protocol=tcp accept'

Replace 10.0.0.0/8 with the networks that need access. Allowing by source address is the rule that matters; "allow 5900" with no source is just "open".

Related ports

• 3389 RDP — Windows Remote Desktop
• 22 SSH — SSH, SCP, SFTP, git over ssh

Part of the port number reference. Ports are 16-bit numbers; see also the subnet calculator and the packet decoder, which shows ports inside TCP and UDP headers.

Questions