Port 5900 — VNC (TCP)
What is Port 5900?
Virtual Network Computing do zdalnego pulpitu.
This is a registered port (1024–49151) often assigned to vendor or application services like VNC. · RFC 6143 (RFB Protocol)
When do you need Port 5900 open?
Open only if you need graphical remote control of a desktop. VNC transmits data unencrypted by default — always tunnel through SSH if the connection crosses an untrusted network.
Common uses and software
- RealVNC Server
- TigerVNC
- TightVNC
- LibreVNC
- macOS Screen Sharing / Apple Remote Desktop
Security
Raw VNC transmits screen data and keystrokes unencrypted. Never expose port 5900 to the internet. Always tunnel VNC through SSH: ssh -L 5900:localhost:5900 user@server followed by connecting to localhost:5900. Alternatively, use a VPN. Set a strong VNC password and disable the password-only auth option in favour of certificate-based auth where your VNC software supports it.
Is Port 5900 safe?
An open port increases your attack surface. Safety depends on how VNC is configured.
Low risk, but confirm that VNC on this port is intentionally running and required by your application before leaving it open.
Test connectivity for Port 5900 on any host.
How to Open Port 5900
To allow incoming connections to Port 5900 (VNC) from outside your network, configure your firewall and add a port forwarding rule on your router pointing to your device's local IP address.
Open Windows Defender Firewall → Advanced Settings → Inbound Rules → New Rule → Port → TCP → Specific local ports: 5900 → Allow the connection → Name and save the rule.
netsh advfirewall firewall add rule name="Open Port 5900" dir=in action=allow protocol=tcp localport=5900sudo ufw allow 5900/tcpsudo iptables -A INPUT -p tcp --dport 5900 -j ACCEPTLog into your router (192.168.1.1 or 192.168.0.1) → Port Forwarding → Add a new rule: Protocol TCP, External port 5900, Internal IP: your device's local IP, Internal port 5900 → Save.
How to close Port 5900
If you do not need VNC, block this port in your firewall or router.
To block port 5900 on Windows, run the following command in PowerShell or Command Prompt (as Administrator):
netsh advfirewall firewall add rule name="Block Port 5900" dir=in action=block protocol=tcp localport=5900sudo ufw deny 5900/tcpsudo iptables -A INPUT -p tcp --dport 5900 -j DROPRemove or disable any port forwarding rule for Port 5900.
Frequently Asked Questions
What is Port 5900 used for?▾
Port 5900 is the default TCP port for VNC. It is used by servers and applications that need to accept incoming connections for this service. Whether you need it open depends on whether you are actively running a VNC server — if not, it should remain closed to reduce your attack surface.
Is Port 5900 safe to keep open?▾
An open Port 5900 increases your attack surface. If you are not actively running VNC, close this port in your firewall and remove any port forwarding rules. If VNC must be accessible, restrict access to known IP ranges, keep the service software updated with security patches, and use strong authentication.