There are many good answers on how to tunnel VNC traffic using SSH. When doing something like...

ssh user@host -L 5900:localhost:5900 x11vnc

...you can connect to the SSH tunnel on localhost:5900 (on the client side) to the SSH. But isn't host:5900 also open for attackers? How can I make x11vnc listening only to the traffic comming from the SSH tunnel?

I'd prefer something temporary and not messing around with iptables or so.

I think the -listen parameter is not what I need, because it listens to the interface with the given IP address:

-listen ipaddr         listen for connections only on network interface with
                       addr ipaddr. '-listen localhost' and hostname work too.

...copied from here.

  • why not have x11vnc listen on the loopback IP addres of ?
    – thrig
    Jan 30 '18 at 20:26
  • @thrig uhh yes... Thank you! I forgot that this was a separate interface... I tried it out and noticed 5900 was open from outside. But actually there was a x11vnc process still running without -listen localhost.
    – lumbric
    Jan 30 '18 at 20:34

Turns out that -listen is what I need. By listening to the device with addr localhost it listens only to the loopback device:

ssh user@host -L 5900:localhost:5900 x11vnc -listen localhost
  • Thanks for answering your own question when you got it to work. This helps all of us.
    – jc__
    Jan 31 '18 at 14:41

For me -listen localhost doesn't worked for ipv6 , and found the correct option is -localhost , man page (man x11vnc) says basically the same as "-allow".

ssh user@host -L 5900:localhost:5900 x11vnc -localhost 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.