Port 5900 (VNC): Uses and Security

What uses port 5900

VNC servers share a graphical desktop on port 5900 for display :0, 5901 for :1 and so on. macOS Screen Sharing uses 5900 as well. Classic VNC authentication is weak and often unencrypted, so tunnel VNC through SSH (ssh -L 5901:localhost:5901 user@host) or a VPN rather than exposing it.

Should port 5900 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

Check what is listening on port 5900

Linux

sudo ss -ltnp 'sport = :5900'

macOS

sudo lsof -nP -iTCP:5900 -sTCP:LISTEN

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 5900 -State Listen
netstat -ano | findstr :5900

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 5900

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

macOS / Linux

sudo kill $(sudo lsof -t -iTCP:5900 -sTCP:LISTEN)

Windows (PowerShell)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 5900 -State Listen).OwningProcess

Allow port 5900 from trusted networks only

The examples allow 5900 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

Ubuntu / Debian (ufw)

sudo ufw allow from 10.0.0.0/8 to any port 5900 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 5900 proto tcp

RHEL / Fedora / Rocky (firewalld)

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="5900" protocol="tcp" accept'
sudo firewall-cmd --reload

Windows (PowerShell, as administrator)

New-NetFirewallRule -DisplayName "VNC 5900/TCP" -Direction Inbound -Protocol TCP -LocalPort 5900 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 5900 from another machine

macOS / Linux

nc -zv example.com 5900

Windows (PowerShell)

Test-NetConnection example.com -Port 5900

Related ports

Port 3389 (RDP): used by RDP, Microsoft’s Remote Desktop Protocol.
Port 22 (SSH): used by SSH for secure remote logins, SFTP, SCP and Git over SSH.

More remote access ports

23 (Telnet) , 1194 (OpenVPN) , 2222 (SSH (alternate)) , 5985 (WinRM (HTTP)) , 5986 (WinRM (HTTPS)) , 51820 (WireGuard) . See all ports in the port lookup.

Sources

IANA port registry: 5900

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What is port 5900 used for?

Port 5900 is used by VNC for remote desktop access. VNC servers share a graphical desktop on port 5900 for display :0, 5901 for :1 and so on. macOS Screen Sharing uses 5900 as well. Classic VNC authentication is weak and often unencrypted, so tunnel VNC through SSH (ssh -L 5901:localhost:5901 user@host) or a VPN rather than exposing it.

Is it safe to open port 5900?

Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel. Allow it only from the networks that need it, as in the firewall examples on this page.

How do I check if port 5900 is open?

On the server, list listening sockets with "sudo ss -ltnp 'sport = :5900'" on Linux or "sudo lsof -nP -i :5900" on macOS. From another machine, run "nc -zv host 5900" or, on Windows, "Test-NetConnection host -Port 5900". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.