Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What's the best way to establish a VNC connection to a computer located behind a firewall/router, to which you don't have access? I have a home Linux computer on a Comcast connection, which explicitly blocks incoming requests, so I can't hit the IP directly, but I'd like to remote into it from an arbitrary Internet connection. How would I work around this?

I've witnessed some commercial products, such as one employed by Dell tech support, which appears to use a public web server, which you visit from the target computer in order to "expose" it to an incoming VNC connection. Is there anything similar that's free/cheap for personal use?

share|improve this question
What all does Comcast block? Most ISPs only block 80, 443, and 25 to prevent people from running web/mail servers. 5900/5901 (or higher if you're using more sessions) are typically unblocked. – Brian Knoblauch Jun 28 '10 at 15:01
As far as I know, Comcast blocks everything that's not initiated from the server. I can't even ping my server, much less connect via VNC. I put the server in my router's DMZ and even disabled the server's firewall to ensure nothing was interfering on my end, but I still can't get to it. – Cerin Jun 29 '10 at 0:19
up vote 3 down vote accepted

You can try tunneling VNC over SSH, but you may find the performance to be a bit slow. You may also want to look into freenx, which is already secure by running over SSH and is much faster than VNC.

If you don't mind using a 3rd party, I really like LogMeIn for it's security and simplicity all in one. All I need is a browser to connect to my PC at home. Your weak link is going to be the password you use for your account, so make sure it's a good one.

share|improve this answer
Thanks, LogMeIn is along the lines of what I was looking for. Although I'd be a little nervous giving a third party remote access to my machine. – Cerin Jun 29 '10 at 0:22
Just realized LogMeIn only supports Windows and Mac. No Linux support at all. Blarrgh. – Cerin Jul 9 '10 at 15:10

You can usually just forward port 5900 from your firewall to the computer that you want to VNC into and then connect to your external IP, or get a DDNS provider if your router/firewall supports it.

share|improve this answer
I have no control over Comcast's firewall. Sorry if my question was unclear. – Cerin Jun 29 '10 at 0:14
@Chris S - I can confirm that Comcast doesn't actually block this, or even 80 for that matter - at least not in Philadelphia. I'd imagine this is the same everywhere. It is possible that your Comcast modem is a combo firewall/router/NAT device. If this is the case, you will need to call Comcast and have them walk you through putting it into bridged mode. This will allow you to have the expected behavior. – MDMarra Jun 29 '10 at 0:42

... visit from the target computer in order to "expose" it to an incoming VNC connection. Is there anything similar that's free/cheap for personal use?

TeamViewer. You'd run the quick-support (or full) module on your target and take with you the session code and password it provides. Enter these into the TV full module on your away machine to connect to the target.

share|improve this answer

Assuming for simplicity that you have only one client (but which can have arbitrary IP's), that the VNC server runs behind a firewall where you can't open ports, but the client has no such problems, a workaround would be to do put this command into an on-boot script on the server:

while sleep 100; do ssh vnc_user@$client -R 5900:; done

This opens a reverse tunnel from the server to the client. This is possible from behind a firewall.

Ensure you've created a passphraseless ssh-key on the server (ssh-keygen, and press return a couple times) so you can put this in a boot script.

Now, in order to do this from an "arbitrary internet connection", simply get a free account at, and exchange $client in the above command for that dyndns address (e.g. On the client, run sshd, and create a user with very little access:

sudo useradd -m -s /bin/false vnc_user

Copy the file server:~/.ssh/ into client:~vnc_user/.ssh/authorized_keys so that the vnc server has ssh access to the vnc client(s). (The /bin/false ensures the vnc server can't actually run commands on the client, only open a port; if you don't trust the server you can do more hardening in sshd_config.)

Now as long as you run a dyndns daemon on the client (or update your IP address manually at, you can connect to the server. If your client changes IP address, the ssh connection should drop and the server will try reestablishing the connection.

(If the client too is behind a firewall, I guess both client and server could open tunnels to a third machine which has no firewall trouble, but in any case you need at least one server which can run sshd against the open Internet.)

share|improve this answer

you can use Hamachi (which was bought by logmein). You install the client on all the machines you want to share then you create a new password protected network and join all the machines to it. Its perfectly safe. Even Steve Gibson recommended it a couple years back. I've used it many times and works like a charm.

They have a free non commercial version.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.