I administrate an Ubuntu 11.10 Server. I've installed tightvncserver on it so I can have a desktop environment on the server.

My issue now is, I'm running into issues with malicious people spamming the VNC server with authentication attempts. I've strengthened up the password, but it's still inconvenient as it restricts me from connecting as the person is using up all the authentication attempts.

There are pretty much around 5 IP addresses that should be able to ATTEMPT to authenticate to the VNC server, this person is using proxies from Romania, China, Korea, etc.

How can I accept authentication attempts to ONLY the IP addresses I specify?

Essentially, I want to do the opposite of this: How to deny VNC access to a particular IP?

And this with VNC instead: How can I allow SSH password authentication from only certain IP addresses?

Any ideas?

Thanks, Brandon

  • Configuring iptables is an option, but so might configuring the VNC server be. Does tight allow configuring a client whitelist? – jippie May 11 '12 at 18:02
  • As a temporary solution, I've just been manually blocking the proxies using iptables as there's only been a few so far. Considering the person is bothering to actually keep trying means they wont be going away easily. – Brandon May 11 '12 at 18:11

You could use ufw - the "uncomplicated firewall" that comes with a standard ubuntu install.

sudo ufw allow 22/tcp
sudo ufw allow 5901/tcp from
sudo ufw default reject incoming
sudo ufw enable

Which is:

  • allow ssh connections (otherwise you will lock yourself out)
  • allow VNC connections from one IP address (edit the port if you don't use 5901)
  • reject all other incoming connections
  • enable the firewall

Make sure you allow ssh before enabling the firewall, otherwise you'll be locked out.

  • 3
    I found that line two of your solution didn't work, though sudo ufw allow from to any port 5901 seemed to do the trick. This allows any protocols, though that can be changed for just TCP. – Noah Buscher Jun 29 '14 at 19:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.