In RHEL/Centos 7, TigerVNC-Server only needs 5901/tcp for desktop:1, then 5902/tcp for desktop:2, and so on. I think any VNC-server would operate the same way.

  • If no one has typed vncerver for themself, I would like the firewall to block all ports >= 5901
  • as more users do vncserver I want those tcp ports 5901..? to be allowed based on desktop:1 to desktop:?
  • when a user does vncserver -kill :? I then want that tcp port to be removed from the run time firewall and that port then blocked.

Is something like this possible to do, if so, how?

Could a wrapper script named vncserver be written to preempt the running of the real /usr/bin/vncserver, and in doing do issue the proper firewall-cmd to make such a thing happen and then perform the real /usr/bin/vncserver?

1 Answer 1


You can run Xvnc -inetd -query localhost as a unprivileged non-root user out of systemd or xinetd. You need a login manager like gdm or lightdm that listens for XDMCP on the loopback interface.

That way you can always connect to the same port and create a new desktop session. Of course, if you disconnect, it ends the session.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .