In RHEL/Centos 7, TigerVNC-Server only needs 5901/tcp for desktop:1, then 5902/tcp for desktop:2, and so on. I think any VNC-server would operate the same way.

  • If no one has typed vncerver for themself, I would like the firewall to block all ports >= 5901
  • as more users do vncserver I want those tcp ports 5901..? to be allowed based on desktop:1 to desktop:?
  • when a user does vncserver -kill :? I then want that tcp port to be removed from the run time firewall and that port then blocked.

Is something like this possible to do, if so, how?

Could a wrapper script named vncserver be written to preempt the running of the real /usr/bin/vncserver, and in doing do issue the proper firewall-cmd to make such a thing happen and then perform the real /usr/bin/vncserver?


You can run Xvnc -inetd -query localhost as a unprivileged non-root user out of systemd or xinetd. You need a login manager like gdm or lightdm that listens for XDMCP on the loopback interface.

That way you can always connect to the same port and create a new desktop session. Of course, if you disconnect, it ends the session.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.