There are many good answers on how to tunnel VNC traffic using SSH. When doing something like...

ssh user@host -L 5900:localhost:5900 x11vnc

...you can connect to the SSH tunnel on localhost:5900 (on the client side) to the SSH. But isn't host:5900 also open for attackers? How can I make x11vnc listening only to the traffic comming from the SSH tunnel?

I'd prefer something temporary and not messing around with iptables or so.

I think the -listen parameter is not what I need, because it listens to the interface with the given IP address:

-listen ipaddr         listen for connections only on network interface with
                       addr ipaddr. '-listen localhost' and hostname work too.

...copied from here.

  • why not have x11vnc listen on the loopback IP addres of ?
    – thrig
    Jan 30, 2018 at 20:26
  • @thrig uhh yes... Thank you! I forgot that this was a separate interface... I tried it out and noticed 5900 was open from outside. But actually there was a x11vnc process still running without -listen localhost.
    – lumbric
    Jan 30, 2018 at 20:34

2 Answers 2


Turns out that -listen is what I need. By listening to the device with addr localhost it listens only to the loopback device:

ssh user@host -L 5900:localhost:5900 x11vnc -listen localhost
  • Thanks for answering your own question when you got it to work. This helps all of us.
    – jc__
    Jan 31, 2018 at 14:41

For me -listen localhost doesn't worked for ipv6 , and found the correct option is -localhost , man page (man x11vnc) says basically the same as "-allow".

ssh user@host -L 5900:localhost:5900 x11vnc -localhost 

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .