I've been searching for hours now, can't figure this one out.

I am trying to make the following happen:

Client: remmina + ssh tunnel

Server: Lubuntu + openssh server (public key authentication) + vino server over ssh tunnel ONLY + allow client to only open 1 port (vnc port)

So far I can connect to my server apparently in both ways (with ssh tunnel and without it), which is unacceptable.

Running vino-preferences GUI doesn't help me much :s

So my question basically is:

  • "How do I block any port opening on server and only single SSH port (22) and allow client to tunnel VNC over SSH via specific port (If it makes sense)?"
  • No other type of VNC connection should be allowed

P.S. I plan to forward port 22 on router to my server and only allow SSH connections.

1 Answer 1


AFAIK the vino-preferences GUI does not include it, but I believe the parameter you are looking for is network-interface

gsettings get org.gnome.Vino network-interface

If unset (i.e. the above command returns the empty string, '') then vino-server listens on all available interfaces, whereas if set to lo

gsettings set org.gnome.Vino network-interface 'lo'

then it will listen only on the lo (localhost) interface.

You could also use the GUI dconf-editor, where the parameter is listed under the org -> gnome -> desktop -> remote-access item.

You can confirm that the server is listening on the desired interface using netstat e.g. the default is

$ sudo netstat -nlp | grep ':5900'
tcp        0      0  *               LISTEN      10927/vino-server
tcp6       0      0 :::5900                 :::*                    LISTEN      10927/vino-server

(listening on all available interfaces); then after

$ gsettings set org.gnome.Vino network-interface 'lo'

you should see that it is only listening on the localhost interface(s):

$ sudo netstat -nlp | grep ':5900'
tcp        0      0*               LISTEN      10927/vino-server
tcp6       0      0 ::1:5900                :::*                    LISTEN      10927/vino-server

Alternatively (or additionally), you could use iptables or ufw to close the port - by default, it is port 5900 + display number.

  • Thanks for introducing me to gsettings/dconf and iptables/ufw, very useful!
    – GogromaT
    Dec 26, 2015 at 2:35
  • Nice, works like a charm! I am able to connect like so: ssh -L LOCAL_PORT:localhost:SERVER_VNC_PORT USER@SERVER_IP and then going to remmina connect like so: Fantastic!
    – GogromaT
    Dec 26, 2015 at 2:59
  • @GogromaT glad to help Dec 26, 2015 at 3:03
  • Alternatively, the OP could just close port 5900 (or whatever port he has the VNC daemon running on.
    – Daniel
    Dec 26, 2015 at 3:54
  • @Daniel yes I think I did mention that Dec 26, 2015 at 4:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.