What is VNC Port?

A VNC port is the TCP network port a VNC server uses for remote desktop connections. Every VNC session depends on this port, even inside a VPS Hosting environment. First, the client and server negotiate the connection over that exact port. Then the session stays open until either side disconnects. Administrators need to understand VNC port numbers, including the exact VNC server port for every display, before they expose any service to a network. RFC 6143 defines how the underlying RFB protocol works. This guide walks through default and custom VNC port configurations. It also covers the security controls that keep remote sessions safe.

The following sections also cover how to change the VNC port in TightVNC and RealVNC. They explain VNC port forwarding, how to open VNC firewall ports safely, and the most common troubleshooting steps too.

What Port Does VNC Use? (Short Answer: 5900)

VNC uses TCP port 5900 by default. This single 5900 port handles the first display, :0, on almost every implementation. Each additional display adds one to that number, so :1 uses 5901 and :2 uses 5902. If someone asks what port does VNC use, 5900 is the answer for a standard single-session setup. Custom deployments can move the VNC server port to any other free TCP port between 1 and 65535.

Related ReadWhat is the Hypixel Server IP Address?

→

What Is VNC?

Virtual Network Computing, or VNC, is a cross-platform remote access protocol. It lets a client view and control a desktop on a separate machine. RDP works primarily within the Windows ecosystem. VNC instead runs on the platform-independent RFB protocol. As a result, VNC behaves consistently across Linux, Windows, and macOS. Many administrators choose VNC for mixed-OS environments. It also suits headless Linux servers and virtual machines that rarely need a graphical session.

VNC Port vs RDP Port (5900 vs 3389)

VNC and RDP solve the same remote-access problem in different ways. The table below compares their default ports and platform support side by side.

Protocol	Default Port	Platform	Encryption by Default
VNC (RFB)	5900	Cross-platform	No
RDP	3389	Windows only	Yes

RDP listens on TCP 3389 by default, and Microsoft’s Remote Desktop Services documentation covers this in detail. VNC’s RFB protocol relies on the 5900 port range instead, and it does not require a specific operating system. Our RDP vs VNC comparison guide breaks down when each protocol makes more sense operationally.

VNC Port Numbers Explained: 5900, 5901, 5902

Default VNC Port vs Display Number

Every VNC server listens on one specific TCP port. The connecting client must target that exact port to open a session. This is why understanding port assignment logic matters for troubleshooting and security. The standard formula is simple:

VNC port = 5900 + display number

So, display :0 uses port 5900. Display :1 uses port 5901, and so on for every additional session. IANA formally registers only port 5900 for VNC and RFB traffic. The remaining ports follow convention, not a formal standard. This distinction matters when firewall rules or scanners assume default ports without verifying the real configuration.

VNC Display Numbers and Port Mapping

The table below shows how VNC display numbers map to TCP ports. It also lists typical use cases and baseline security guidance for each range.

VNC Port Range for Multiple Sessions

Most single-user servers only need port 5900. Environments running several sessions at once rely on a wider VNC port range instead. Each new display claims the next port in sequence, so five active sessions might span 5900 through 5904. Teams managing shared or multi-user servers should reserve enough of this range in advance. Then, document it for the security and firewall teams.

Display	VNC Port	Typical Use Case	Security Recommendation
:0	5900	Primary remote session	Restrict by firewall and tunnel through SSH
:1	5901	Secondary session or second user	Bind to localhost or route through a VPN
:2 – :10	5902 – 5910	Multi-user or multi-VM environments	Segment with VLANs and access control lists
N/A	5800	Legacy Java web viewer access	Disable unless browser-based access is required
Custom	e.g. 15900+	Hardened production deployments	Pair with VPN or TLS; never rely on obscurity alone

Some administrators assume a higher-numbered display is inherently safer than the default. However, the port number itself provides no protection. Every mapped port still needs the access controls covered later in this guide, no matter which number it uses.

How to Change the VNC Port (TightVNC & RealVNC)

Changing the default VNC port does not replace proper security controls. Many teams still change it to cut down on automated scan noise. The exact steps depend on the VNC implementation.

TightVNC (Windows)

1. Open the TightVNC Server configuration window.
2. Select the Server tab.
3. Locate the Main Port field (also called TCP Port).
4. Replace the default value 5900 with the preferred port number.
5. Click OK, then restart the TightVNC service so the change takes effect.

TightVNC (Linux, via vncserver)

Linux systems that launch sessions with the standard vncserver command can bind a specific port at startup. This works independently of the display number:

vncserver :5 -rfbport 5905

Administrators can also add the same -rfbport flag to ~/.vnc/config. The server then applies the setting automatically on every restart.

RealVNC

1. Open the RealVNC Server user interface.
2. Go to Options, then Connections.
3. Locate the RfbPort parameter, also available under Options > Expert. The RealVNC Server Parameter Reference documents the full parameter set.
4. Set RfbPort to any value between 1 and 65535. Note that operating systems typically restrict ports 1 through 1024.
5. Restart RealVNC Server so the new port takes effect.

Headless RealVNC deployments can set the same parameter directly inside the server’s config file. This approach works well for automated provisioning across many virtual machines.

How to Open VNC Ports in the Firewall (UFW, firewalld, Windows)

Changing the VNC port accomplishes nothing if a local firewall still blocks it. Each operating system opens VNC firewall ports a little differently.

UFW (Ubuntu and Debian)

• sudo ufw allow 5900/tcp
• sudo ufw allow 5900:5910/tcp
• sudo ufw reload

Scope the rule to a trusted source IP whenever possible, for example:

sudo ufw allow from 203.0.113.10 to any port 5900 proto tcp

firewalld (RHEL, CentOS, AlmaLinux)

• sudo firewall-cmd –permanent –add-port=5900/tcp
• sudo firewall-cmd –permanent –add-port=5900-5910/tcp
• sudo firewall-cmd –reload

The –permanent flag keeps the rule active after a reboot. The –reload command applies it immediately.

Windows Firewall

1. Open Windows Defender Firewall with Advanced Security.
2. Select Inbound Rules, then New Rule.
3. Choose Port, then TCP, and enter 5900 (or a range such as 5900-5910).
4. Restrict the rule to trusted network profiles only.
5. Name the rule and save it.

Treat every open VNC firewall port as a monitored asset. Review the rule regularly, not just once at setup.

How VNC Port Forwarding Works

Port forwarding lets a router or firewall pass external connection requests to an internal VNC server. Picture TightVNC or RealVNC running on the default ports, 5900 and 5800. Administrators configure the router to forward inbound traffic on those ports to the internal machine, for example 192.168.1.100.

Once the forwarding rule is active, a remote client connects to the router’s public IP address. It uses the specified port, exactly like a direct connection to the target machine. However, this convenience creates real exposure risk. RFB traffic carries no encryption by default. So, forwarding a raw VNC port straight to the public internet exposes the session to interception and credential theft. For that reason, most production environments forward VNC traffic only through a VPN gateway or an SSH tunnel.

Is Port 5900 Safe to Expose?

No, not on its own. Port 5900 carries no built-in encryption or rate limiting. Exposing it directly to the public internet invites automated scanners within minutes. The port itself is not the real problem; the missing controls around it are. A firewall rule, a VPN tunnel, or an SSH tunnel changes the picture. Any of them turns the same 5900 port into a reasonably safe access path. Without one of those layers, treat any publicly reachable VNC port as compromised until proven otherwise.

VNC Port Security Best Practices

The RFB protocol does not guarantee encryption on its own. Administrators must add extra controls around the VNC port to keep sessions secure. The following practices apply across TightVNC, RealVNC, and most other implementations.

• SSH Tunneling: bind the VNC server to localhost (127.0.0.1) and require an SSH tunnel before any connection. This remains the standard approach for Linux environments, and it adds strong encryption without extra software.
• VPN Access: restrict the VNC port to a private network reachable only through WireGuard or OpenVPN. This approach satisfies segmentation requirements in regulated environments.
• Firewall and IP Allowlisting: apply a default-deny policy. Permit only known IP addresses through iptables, nftables, or cloud security groups.
• TLS Encryption: modern implementations such as RealVNC and TigerVNC support native encryption. Administrators should confirm this capability rather than assume every deployment uses it.
• Multi-Factor Authentication: VNC rarely supports MFA natively. Most teams add it through the VPN layer, the SSH layer, or PAM integration.
• Custom Ports: moving VNC off port 5900 reduces automated scan noise. It does not function as a real security control on its own.

These controls also support broader compliance frameworks such as PCI DSS, ISO 27001, HIPAA, and GDPR. Configuring the VNC port correctly does not guarantee compliance by itself, though. Each framework still requires documented access logs, encryption in transit, and periodic access reviews.

Troubleshooting VNC Port Issues

• Connection refused: this usually means the VNC service is not running. It can also mean a firewall is blocking the port, or the client is targeting the wrong display number.
• Blank or black screen: this often points to a missing desktop environment. On minimal Linux installations, check our guide on how to install a GUI on Ubuntu Server. A VNC session cannot render a desktop that nobody installed.
• Port already in use: this happens when a previous session did not shut down cleanly. Killing the stale process or picking a new display number resolves it quickly.
• Authentication failures after a port change: this typically happens when the client still points to the old port. Update the client with the new port number to fix it.
• Slow or laggy sessions: this usually points to a bandwidth or encoding issue rather than a port problem. Switching encoding methods or lowering color depth often helps.

VNC Port Use Cases by Industry

A VNC port operates independently of the primary application stack. This gives teams across many industries a reliable fallback path for remote access. The specific use case usually shapes which security controls come first.

• SaaS and Cloud: engineering teams rely on VNC port access for OS-level debugging, VM recovery, and backup access whenever SSH goes down.
• iGaming: operators use VNC port access for real-time server maintenance and emergency fixes. Regulated licenses require documented, auditable access records.
• Fintech: administrators connect through encrypted VNC sessions to manage payment platforms and trading systems. These sessions must align with PCI DSS encryption requirements.
• Healthcare: IT staff use VNC port access to reach PACS systems and imaging workstations. HIPAA requires both encryption and logging for these sessions.
• Media and Streaming: engineers use VNC ports to manage rendering nodes and encoding servers. These systems rarely include a permanent local display.
• Hosting and Data Centres: providers treat VNC port access as an out-of-band recovery path. It helps whenever a firewall misconfiguration, network outage, or OS crash blocks normal SSH access.

VNC Port Access on Hosted Infrastructure

HostingB2B’s Linux VPS Hosting plans include direct VNC console access through the Virtualizor control panel. Administrators do not need to configure any port settings on the client side. This proves especially useful during recovery scenarios. If SSH becomes unreachable because of a firewall misconfiguration or a broken network stack, the console still works. It gives an out-of-band path to the server’s console session. The connection runs through the hosting provider’s control panel rather than a directly exposed port. The same access controls and audit logging apply here too. Emergency access, as a result, stays consistent with the rest of the security posture.

FAQ

Conclusion

The VNC port remains a foundational element of remote server administration, whether the underlying infrastructure runs on-premises or on hosted virtual machines. As this guide has shown, the default formula of 5900 plus the display number explains most port assignments, but that numbering scheme should never be treated as a security measure on its own. Instead, combining SSH tunnels, VPN access, firewall allowlisting, and TLS encryption gives the VNC port the protection that the RFB protocol does not provide natively. Teams that apply these controls consistently end up with a flexible, cross-platform remote access option that fits cleanly into a broader VPS hosting security strategy.