Port reference
Port 5900 (TCP) – VNC
Virtual Network Computing — graphical remote desktop sharing protocol (RFB).
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Open on hosts running a VNC server (RealVNC, TightVNC, TigerVNC, macOS Screen Sharing). Frequently exposed to the internet with weak or no authentication.
What is port 5900 used for?
Port 5900 is the default port for VNC (Virtual Network Computing), a graphical remote-desktop protocol that lets you see and control another computer's screen, keyboard, and mouse. It is widely used for remote support and accessing headless machines, and works across platforms. Common servers include RealVNC, TightVNC, TigerVNC, and macOS Screen Sharing, with each extra display adding to the port number (:0 is 5900, :1 is 5901).
When would you open it?
Open port 5900 when you need to remotely view or control a computer running a VNC server, for example a home PC, a lab machine, or a Mac with Screen Sharing turned on. For anything beyond a trusted local network, reach it over SSH or a VPN rather than forwarding the port directly.
Is it safe to open?
Classic VNC has weak passwords and unencrypted sessions and is heavily scanned, so never expose it to the internet directly and always tunnel it. See the security notes below.
How to check if this port is open
ss -tulpn | grep :5900
nmap -p 5900 <target>netstat -ano | findstr :5900
Test-NetConnection <host> -Port 5900lsof -i :5900
nmap -p 5900 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 5900 to your device's local IP, internal port 5900, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 5900/tcpsudo firewall-cmd --permanent --add-port=5900/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5900 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 5900" -Direction Inbound -Protocol TCP -LocalPort 5900 -Action AllowSecurity & risks
Common attacks
- Brute force of the weak 8-character VNC password
- Access to servers configured with no authentication at all
- Eavesdropping on unencrypted screen and keystroke traffic
- Auth-bypass exploits (e.g. RealVNC CVE-2006-2369)
Hardening
- Never expose 5900 to the internet — tunnel over SSH or a VPN
- Always require a password; prefer servers supporting full credential auth
- Use a VNC build with strong/TLS encryption, or wrap VNC in an encrypted tunnel
- Restrict source IPs and add rate limiting/lockout
- Patch the VNC server; older builds have auth-bypass and RCE bugs
How to block this port
sudo ufw deny 5900/tcpsudo firewall-cmd --permanent --remove-port=5900/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5900 -j DROPNew-NetFirewallRule -DisplayName "Block 5900" -Direction Inbound -Protocol TCP -LocalPort 5900 -Action Blocknmap snippet
nmap -p5900 --script vnc-info,vnc-title,realvnc-auth-bypass <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is VNC on port 5900 secure?
- Not by default. Classic VNC limits passwords to 8 characters and sends the screen unencrypted, and some servers allow no authentication. Tunnel it over SSH/VPN and require strong auth.
- What is the difference between 5900 and 5901?
- 5900 is the first VNC display (:0). Additional displays increment the port, so :1 is 5901, :2 is 5902, and so on. Each display is a separate VNC session.