Port reference
Port 5800 (TCP) – VNC over HTTP
HTTP service that delivers a browser-based VNC client, paired with the VNC server on port 5900.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on VNC servers with the built-in web/Java viewer enabled (e.g. RealVNC, TightVNC). Often exposed alongside 5900 with weak or no authentication.
What is port 5800 used for?
Port 5800 is the HTTP port that some VNC servers use to serve a browser-based VNC viewer, so you can control a remote desktop without installing a separate client. You open http://host:5800/ in a browser, the viewer loads, and it connects to the actual VNC server on port 5900. VNC products such as RealVNC and TightVNC have offered this web viewer, originally as a Java applet and later in JavaScript.
When would you open it?
Open port 5800 only if you genuinely want browser-based access to a VNC desktop and the web viewer is enabled. Many setups skip it entirely and use a native VNC client on 5900 instead, and for remote use it is safest reached over SSH or a VPN rather than directly.
Is it safe to open?
The web viewer carries the same weak passwords and unencrypted sessions as VNC itself, so keep it off the internet and tunnel access. See the security notes below.
How to check if this port is open
ss -tulpn | grep :5800
nmap -p 5800 <target>netstat -ano | findstr :5800
Test-NetConnection <host> -Port 5800lsof -i :5800
nmap -p 5800 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 5800 to your device's local IP, internal port 5800, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 5800/tcpsudo firewall-cmd --permanent --add-port=5800/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5800 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 5800" -Direction Inbound -Protocol TCP -LocalPort 5800 -Action AllowSecurity & risks
Common attacks
- Connecting to no-auth or weakly authenticated desktops via the browser
- Brute force of the short VNC password reached through the web client
- Fingerprinting exposed VNC web pages with http-title scanning
- Eavesdropping on the unencrypted session served behind the page
Hardening
- Disable the HTTP/web viewer if you do not need browser access
- Never expose 5800 or 5900 to the internet — tunnel over SSH or VPN
- Require a strong VNC password and prefer TLS-capable servers
- Restrict source IPs and add rate limiting/lockout
- Keep the VNC server patched against auth-bypass and RCE bugs
How to block this port
sudo ufw deny 5800/tcpsudo firewall-cmd --permanent --remove-port=5800/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5800 -j DROPNew-NetFirewallRule -DisplayName "Block 5800" -Direction Inbound -Protocol TCP -LocalPort 5800 -Action Blocknmap snippet
nmap -p5800 --script http-title,vnc-info <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- How is 5800 different from 5900?
- 5900 is the raw VNC (RFB) protocol port. 5800 is an HTTP port that serves a Java/JavaScript VNC client to a browser, which then connects back to the VNC server on 5900.
- Is the VNC web client on 5800 secure?
- No more than VNC itself. It fronts the same weak password scheme and unencrypted session, so an exposed 5800 lets anyone reach the desktop from a browser. Tunnel it and require strong auth.