Ever wanted to control your Linux desktop from another PC, laptop, or even your Android phone?
In this tutorial, we’ll build a complete remote-desktop setup using:
Linux
x11vnc
AVNC on Android
Local network access
UFW firewall
Internet access
SSH tunneling
CGNAT troubleshooting- Patience
The goal is to start with a simple VNC connection inside your home network and then build toward a secure remote-access setup.
Important: VNC works very well on a trusted LAN, but directly exposing port
5900to the public Internet is not the approach I’d recommend. We’ll cover port forwarding so you understand how it works, but the preferred remote setup in this guide is VNC over SSH or a VPN.
What Are We Building?
We’ll start with this:
┌──────────────────────────────────────────┐
│ HOME NETWORK │
│ │
│ ┌──────────────┐ ┌────────────┐ │
│ │ Linux PC │ │ Android │ │
│ │ │◄──────│ Phone │ │
│ │ x11vnc :5900 │ VNC │ AVNC │ │
│ └──────────────┘ └────────────┘ │
│ │
└──────────────────────────────────────────┘
Then we’ll understand how Internet access works:
INTERNET
│
▼
┌─────────────┐
│ ROUTER │
│ NAT / FW │
└──────┬──────┘
│
▼
┌─────────────┐
│ Linux PC │
│ │
│ x11vnc :5900│
└─────────────┘
And finally, the safer remote design:
INTERNET
│
│ encrypted SSH
▼
┌─────────────┐
│ ROUTER │
└──────┬──────┘
│
▼
┌─────────────┐
│ Linux PC │
│ │
│ SSH │
│ │ │
│ x11vnc :5900│
└─────────────┘
▲
│
AVNC
Requirements
Linux PC
You’ll need:
- A Linux desktop running X11
x11vnc- A user account logged into the graphical desktop
- Network connectivity
Client
You can use:
- AVNC on Android
- TigerVNC Viewer
- Remmina
- RealVNC Viewer
- Other compatible VNC clients
For this tutorial, I’ll use AVNC on Android.
AVNC is an Android VNC client and includes features such as SSH tunneling, TLS support, clipboard synchronization, view-only mode, and automatic server discovery.
Check Whether You’re Using X11
This tutorial uses x11vnc, which shares an existing X11 display.
Run:
echo $XDG_SESSION_TYPE
If you get:
x11
you’re good.
If you get:
wayland
x11vnc may not be the correct solution for your desktop session.
Check your display:
echo $DISPLAY
A common result is:
:0
x11vnc is specifically designed to connect to real X11 displays.
Install x11vnc
Debian / Ubuntu / Linux Mint / Ubuntu-based distributions
sudo apt update
sudo apt install x11vnc
Fedora
sudo dnf install x11vnc
Arch Linux
sudo pacman -S x11vnc
Verify:
x11vnc -version
Create a VNC Password
Don’t leave your VNC server unauthenticated.
Create the VNC directory:
mkdir -p ~/.vnc
Then create a password:
x11vnc -storepasswd ~/.vnc/passwd
You’ll be asked for a VNC password.
You should now have:
~/.vnc/passwd
The x11vnc documentation specifically recommends using a VNC password through options such as -rfbauth or -passwdfile.
Find Your Linux PC’s Local IP
Run:
hostname -I
For example:
192.168.1.100
Your address will probably be different.
You can also inspect the interfaces with:
ip addr
For the rest of this tutorial, I’ll use:
192.168.1.100
Replace that with your actual address.
Start x11vnc
Now start the server:
x11vnc \
-display :0 \
-rfbauth ~/.vnc/passwd \
-forever \
-shared
The important options are:
-display :0
Share the X11 display :0.
-rfbauth ~/.vnc/passwd
Use the VNC password.
-forever
Keep listening after a client disconnects.
-shared
Allow multiple VNC clients.
When x11vnc starts listening, it normally reports a port such as:
PORT=5900
For display :0, TCP 5900 is the usual VNC port.
Connect Using AVNC
Open AVNC on your Android phone.
Create a new server.
Use:
Host:
192.168.1.100
Port:
5900
Then enter the VNC password.
Your phone and Linux PC must currently be reachable from the same LAN.
For example:
Android
192.168.1.50
│
│ Wi-Fi
▼
Router
│
│ Ethernet/Wi-Fi
▼
Linux PC
192.168.1.100
│
▼
x11vnc :5900
If everything works, you should now see your Linux desktop on your phone.
LAN VNC is working.
What You Should See in AVNC
Your AVNC connection should look conceptually like:
┌─────────────────────────┐
│ VNC Connection │
│ │
│ Host: 192.168.1.100 │
│ Port: 5900 │
│ │
│ Password: ******** │
│ │
│ CONNECT │
└─────────────────────────┘
The exact AVNC interface may differ between versions.
Configure the Firewall
If you’re using UFW:
sudo ufw status
If UFW is enabled, allow VNC only from your local network.
For example, if your LAN is:
192.168.1.0/24
use:
sudo ufw allow \
from 192.168.1.0/24 \
to any port 5900 \
proto tcp
Then check:
sudo ufw status
You should see a rule allowing TCP 5900 from your LAN.
Why not simply do this?
sudo ufw allow 5900/tcp
That allows connections to port 5900 from anywhere that can reach the machine.
For a normal home LAN setup, restricting it to your local subnet is a better default.
Test the VNC Port
From another Linux machine on the same network:
nc -vz 192.168.1.100 5900
A successful result should indicate that TCP port 5900 is reachable.
You can also check the server itself:
ss -lntp | grep 5900
If x11vnc is listening, you should see TCP port 5900.
Give Your Linux PC a Stable LAN Address
If your Linux PC changes from:
192.168.1.100
to:
192.168.1.127
your AVNC connection will stop working.
A simple solution is to create a DHCP reservation in your router.
For example:
Linux PC MAC address
↓
192.168.1.100
Your router will then keep assigning that address to the machine.
1
What Changes When You Leave Your Home?
Inside your LAN, your phone can connect directly to:
192.168.1.100:5900
But 192.168.x.x addresses are private addresses.
Your phone on mobile data cannot normally connect directly to:
192.168.1.100
You need a way through your home router.
That’s where NAT and port forwarding come in.
Port Forwarding Explained
Suppose your Linux PC is:
192.168.1.100
You could configure your router like this:
External TCP port: 5900
Internal IP:
192.168.1.100
Internal TCP port:
5900
Conceptually:
INTERNET
│
│ TCP 5900
▼
┌─────────────┐
│ ROUTER │
│ │
│ Port 5900 │
└──────┬──────┘
│
│ NAT
▼
192.168.1.100
│
▼
x11vnc :5900
The exact interface depends on your router.
You may see names such as:
- Port Forwarding
- NAT
- Virtual Server
- Port Mapping
- NAT Rules
1 Don’t Rush to Expose Port 5900
This is the most important part of the tutorial.
Port forwarding makes a service reachable from the Internet.
That means:
Before:
Internet
X
│
│ blocked
▼
x11vnc
After:
Internet
│
▼
Router
│
▼
x11vnc :5900
Now your VNC service is exposed to the public Internet.
A VNC password is useful, but a password alone should not be your entire Internet security strategy.
For remote access, I recommend using:
SSH tunneling or a VPN instead of directly exposing VNC.
1 Install an SSH Server
On Debian/Ubuntu:
sudo apt install openssh-server
Check it:
sudo systemctl status ssh
Test SSH from another machine on your LAN:
ssh [email protected]
Replace username with your Linux username.
Don’t move to Internet access until SSH works locally.
1 Restrict x11vnc to Localhost
For SSH tunneling, you can make x11vnc listen only on localhost:
x11vnc \
-localhost \
-display :0 \
-rfbauth ~/.vnc/passwd \
-forever
Now x11vnc isn’t intended to accept direct connections from other network interfaces.
The SSH connection will carry the VNC traffic.
This is also the SSH-tunnel approach documented by upstream x11vnc.
1 Create the SSH Tunnel
From the remote device:
ssh -L 5900:localhost:5900 username@YOUR_PUBLIC_IP
For example:
ssh -L 5900:localhost:5900 [email protected]
Keep this SSH session open.
The tunnel looks like:
Remote device
│
│ localhost:5900
▼
SSH
│
│ encrypted tunnel
▼
Linux PC
│
▼
localhost:5900
│
▼
x11vnc
The x11vnc documentation itself gives an SSH tunneling pattern using:
ssh -t -L 5900:localhost:5900
and recommends tunneling VNC through an encrypted channel such as SSH.
1 Connect AVNC Through the Tunnel
Now configure AVNC to connect to:
Host:
127.0.0.1
Port:
5900
Not:
YOUR_PUBLIC_IP:5900
The connection is:
AVNC
│
│ localhost:5900
▼
SSH tunnel
│
▼
Linux PC
│
▼
x11vnc
AVNC also has a built-in SSH tunnel feature, so you don’t necessarily need a separate SSH application on Android.
1 The Difference Between the Two Setups
Direct VNC
AVNC
│
│ Internet
▼
Router
│
│ TCP 5900
▼
x11vnc
Simple, but not my preferred Internet configuration.
VNC over SSH
AVNC
│
│ SSH
▼
Router
│
▼
Linux PC
│
├── SSH
│
└── x11vnc :5900
The VNC connection travels through the encrypted SSH tunnel.
1 What If Your Public IP Changes?
Residential connections may have dynamic public IP addresses.
For example:
Today:
203.0.113.50
Later:
203.0.113.81
Then you would have to find the new address.
A common solution is Dynamic DNS (DDNS).
Instead of connecting to:
203.0.113.50
you can use a hostname such as:
my-linux-pc.example.net
The DDNS service updates the hostname when your public IP changes.
1 What If Port Forwarding Doesn’t Work?
Don’t immediately assume you configured the router incorrectly.
Your ISP may use CGNAT.
The architecture can look like:
Internet
│
▼
ISP CGNAT
│
▼
Your Router
│
▼
Linux PC
In this situation, your router may not actually have a publicly reachable IPv4 address.
You can configure:
TCP 22 → Linux PC
or:
TCP 5900 → Linux PC
perfectly and still be unable to connect from outside.
2 What Can You Use Instead of Port Forwarding?
If you’re behind CGNAT, or simply don’t want to expose services directly, consider:
- WireGuard
- Tailscale
- ZeroTier
- Another private VPN/overlay network
The architecture becomes:
Phone
│
│ Private VPN
▼
Linux PC
│
▼
x11vnc
This is often much cleaner than exposing VNC directly.
2 Troubleshooting Checklist
x11vnc isn’t starting
Check:
echo $DISPLAY
Try:
x11vnc -display :0
Make sure an X11 desktop session is actually running.
AVNC can’t connect on LAN
Check the IP:
hostname -I
Check the VNC server:
ss -lntp | grep 5900
Check UFW:
sudo ufw status
Check connectivity:
nc -vz 192.168.1.100 5900
It works locally but not remotely
Check:
- Router port forwarding
- Linux firewall
- Correct internal IP
- Public IP
- ISP CGNAT
- Whether the router itself has a public IPv4 address
SSH works but AVNC doesn’t
Check that the tunnel exists:
ss -lntp | grep 5900
Then make AVNC connect to:
127.0.0.1:5900
not the public IP.
2 Improve SSH Security
If you’re exposing SSH for remote access, don’t stop at the default configuration.
Consider:
- SSH keys
- Disabling password authentication
- Firewall restrictions
- Keeping OpenSSH updated
- Brute-force protection
- A VPN instead of public SSH when appropriate
For example, SSH keys are preferable to relying solely on a password.
Changing SSH from port 22 to another port can reduce automated scanning noise, but it is not a replacement for real authentication and firewall security.
2 Performance Tips for Old PCs
VNC can work surprisingly well on older hardware, but desktop effects can make remote control slower.
For a lightweight desktop, consider disabling:
- Transparency
- Heavy animations
- Blur effects
- Large wallpapers
- Unnecessary compositing effects
You can also experiment with x11vnc options related to performance.
The goal is simple:
Less rendering
↓
Less data
↓
Less bandwidth
↓
Better remote desktop experience
This can be particularly useful when the Linux machine is old or running over a slower network.
2 Useful x11vnc Options
Here’s a small cheat sheet:
| Option | Purpose |
|---|---|
-display :0 |
Share X11 display :0 |
-rfbauth ~/.vnc/passwd |
Use VNC password |
-forever |
Continue after disconnect |
-shared |
Allow multiple clients |
-localhost |
Restrict connections to localhost |
-rfbport 5900 |
Explicitly select VNC port |
-auth guess |
Try to locate X authority |
For example:
x11vnc \
-display :0 \
-rfbauth ~/.vnc/passwd \
-forever \
-shared
The upstream documentation lists these options and describes -display, -rfbport, -localhost, authentication, and other configuration modes.
2 Make It Start Automatically
Once the manual setup works, you can automate it with a systemd user service.
For example:
~/.config/systemd/user/x11vnc.service
A basic service could look like:
[Unit]
Description=x11vnc server
After=graphical-session.target
[Service]
ExecStart=/usr/bin/x11vnc -display :0 -rfbauth %h/.vnc/passwd -forever -shared
Restart=on-failure
[Install]
WantedBy=default.target
Then:
systemctl --user daemon-reload
systemctl --user enable --now x11vnc.service
However, desktop-session timing and Xauthority permissions vary between distributions and display managers.
Get the manual command working first. Automate second.
2 Recommended Testing Order
Don’t configure everything at once.
Test it in this order:
Test 1 — Local machine
x11vnc -display :0
↓
Test 2 — LAN
Linux PC ←→ AVNC
↓
Test 3 — Firewall
Confirm UFW allows LAN access.
↓
Test 4 — SSH
Remote machine ←→ SSH ←→ Linux PC
↓
Test 5 — SSH tunnel
Remote VNC client
↓
SSH tunnel
↓
x11vnc
↓
Test 6 — Internet
Only after everything above works should you configure remote access.
This makes troubleshooting much easier.
Final Setup
For a simple home LAN:
HOME LAN
┌───────────────────────┐
│ │
│ Linux PC │
│ 192.168.1.100 │
│ │
│ x11vnc :5900 │
│ ▲ │
│ │ │
└───────┼───────────────┘
│
VNC
│
▼
Android / AVNC
For remote access:
INTERNET
│
│ SSH / VPN
▼
┌─────────────┐
│ ROUTER │
└──────┬──────┘
│
▼
┌─────────────┐
│ Linux PC │
│ │
│ SSH │
│ │ │
│ x11vnc :5900│
└─────────────┘
▲
│
AVNC
Conclusion
With x11vnc and AVNC, you can turn a Linux desktop into a simple remote graphical workstation.
The interesting part isn’t really VNC itself.
It’s understanding how all the pieces fit together:
X11
↓
x11vnc
↓
TCP 5900
↓
LAN
↓
AVNC
And when you need remote access:
X11
↓
x11vnc
↓
SSH / VPN
↓
Internet
↓
AVNC
This can be particularly useful for old computers that aren’t powerful enough to carry around but still make perfectly good home servers or workstations.
Have you used VNC on Linux before?
What do you prefer for remote access:
x11vnc- TigerVNC
- RustDesk
- SSH + VNC
- WireGuard/Tailscale
- Something else?
Share your setup and let’s compare them.