1

I am running into some trouble accessing my Raspberry Pi (running Raspbian) from my WAN IP.

  • TightVNCserver is installed and running on port 5901 on the Raspberry Pi.
  • Port forwarding is enabled on my router/switch from 5900 to 5901 going to the Raspberry Pi’s internal address.
  • If using the internal 192.x.x.x address the Raspberry Pi is accessible.
  • When attempting to access the Raspberry Pi from my external WAN with port 5901 specified I receive “connection refused.”
  • Ran a nmap -sV scan to verify port 5901 is open on the Raspberry Pi.
  • Temporarily disabled my router’s firewall to see if it was blocking anything and got the same results.

Any thoughts?

Improve this question
7
  • first use canyouseeme.org to confirm that the NAT rule is working correctly. Also note that VNC is not a safe protocol to expose externally, and it is likely that your ISP is blocking 5900-5910 so consider using a differant port. All in all, it is best to tunnel VNC over SSH if you want to expose it externally. hertaville.com/2012/09/27/raspbian-raspberry-pi
    – Frank Thomas
    Sep 6, 2015 at 23:13
  • One idea is that your ISP is blocking port 5900 so even with the firewall disabled, 100% no traffic no matter what you do. Another idea is perhaps you are not passing the correct protocol. It should be port 5900 using TCP.
    – Giacomo1968
    Sep 6, 2015 at 23:23
  • @FrankThomas probably right that VNC isn't that safe externally i'm not sure what protocol is so perhaps any should be wrapped in SSH.. But do you have a source for that re VNC not being safe?
    – barlop
    Sep 7, 2015 at 0:14
  • @barlop, I can only suggest you google so that the information does not become outdated, but it comes down to these primary concerns. First, in the generic VNC supports no connection encryption, so the stream can be copied and viewed by users on intermediary networks. Some specific VNC implementations (Ultra for instance) can encrypt the stream if the client and server are paired, but there are a host of limitations. Second, for legacy reasons most VNC server implementations limit passwords to 8-characters, and don't like specials. this is also vendor dependent.
    – Frank Thomas
    Sep 7, 2015 at 0:38
  • @barlop, there are some protocols that are safe, like TeamViewer, and RDP can be secured, but Indeed, most LAN protocols should be run either through an SSH gateway, or a strong VPN (preferably L2TP/IPSec, and preferably not SSL).
    – Frank Thomas
    Sep 7, 2015 at 0:41

1 Answer 1

Reset to default
1

You say:

  • Port forwarding [..] on my router/switch from 5900 to 5901
  • attempting to access [..] from my external WAN with port 5901

If this is correct, you’re trying to access a port (5901) that you've not told your router to forward (you told it to forward connections to 5900 on the outside to 5901 on the Raspberry Pi).

I’m not sure why you forwarded 5900 to 5901, but if that is the case you'll want to try and connect to 5900 from the outside. Alternatively, map 5901 to 5901 for a less confusing setup.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .