tightvnc connection refused when using IP address & accepted with localhost

**lance bermudez** · January 25th, 2020

ubuntu 1804

using tight vnc NOT tiger vnc
tightvnc connection refused when using IP address & accepted with localhost
Did have gnome desktop installed but switched over to xfce4 xubuntu because I could get tightvnc working but only for local host. Need it to work for the IP address not the local host.

~/.vnc/xstartup

Code:

#!/bin/sh
unset SESSION_MANAGER
unset DBUS_SESSION_BUS_ADDRESS
exec startxfce4

start/stop tightvncserver

Code:

to start server
tightvncserver :1

to stop
tightvncserver -kill :1

nmap of vnc ports

Code:

$ sudo nmap tardis -p 5900,5901,5902
PORT     STATE  SERVICE
5900/tcp closed vnc
5901/tcp open   vnc-1
5902/tcp closed vnc-2

**The Cog** · January 25th, 2020

Is it configured to only listen on localhost? Many services come that way so you can test and configure their security locally before reconfiguring them to accept external connections.
This command will show what addresses/ports are listening:

Code:

sudo ss -lntp

It may also be your firewall rules of course.

**lance bermudez** · January 25th, 2020

$ sudo ss -lntp

Code:

LISTEN   0        5                  0.0.0.0:5901            0.0.0.0:*       users:(("Xtightvnc",pid=31971,fd=3))         
LISTEN   0        128                0.0.0.0:6001            0.0.0.0:*       users:(("Xtightvnc",pid=31971,fd=0))

and ufw is turned off

Code:

$ sudo ufw status verbose
Status: inactive

**The Cog** · January 26th, 2020

That looks like xtightvnc is listening on all local addresses for ports 5901 and 6001. There should be no difference between connecting on localhost and connecting on other local addresses.
Connections from external sources from elsewhere are another matter, and rely on correct IP routing configuration.

To verify that you really don't have any firewall rules in operation, run this command - if it returns without printing anything then you really don't have any firewall rules - please check this:

Code:

sudo iptables-save

When you say refused when using IP address, are you trying this from local or from another machine?

**lance bermudez** · January 30th, 2020

$ ssh -L 5901:127.0.0.1:5901 -C -N -l lance 192.168.2.5
then use localhost:5901
gsettings list-recursively org.gnome.Vino

to not have to do the above then set the require-encryption to false
gsettings get org.gnome.Vino require-encryption
gsettings set org.gnome.Vino require-encryption false

**The Cog** · January 30th, 2020

Code:

ssh -L 5901:127.0.0.1:5901 -C -N -l lance 192.168.2.5
then use localhost:5901

I understand that. Looks OK to me. Tunnel 5901 from local PC to the destination's 5901.
Be aware that by default, this tunnel is only listening at your local PC on 127.0.0.1. To get it to listen on all addresses, use:

Code:

ssh -L 0.0.0.0:5901:127.0.0.1:5901 -C -N -l lance 192.168.2.5

I don't understand what this is all about:

Code:

gsettings list-recursively org.gnome.Vino

to not have to do the above then set the require-encryption to false
gsettings get org.gnome.Vino require-encryption
gsettings set org.gnome.Vino require-encryption false