Accessing Your Mac Server via VNC over SSH

VNC (Screen Sharing) is the easiest way to get a graphical desktop on your hosted Mac. macOS Screen Sharing encrypts the connection, so the traffic itself is not the problem. The problem is that port 5900 is exposed to the public internet. Anyone can find it with a port scan and try to brute-force their way in.

A better approach: tunnel VNC through SSH. This lets you block port 5900 entirely in your firewall and access VNC only through SSH. You get the same Screen Sharing experience, but nothing is exposed to the public internet except SSH.

This works with the standard SSH server built into macOS. No extra software or VNC configuration needed.

TL;DR

Use the below one-liner to open a SSH tunnel and launch Screen Sharing through it immediately. The rest of this article explains what it does and how to close port 5900 afterwards.

ssh -f -o ExitOnForwardFailure=yes -L 12345:localhost:5900 your_username@your_server_ip sleep 10 && open vnc://localhost:12345

How it works

Instead of connecting to your server's VNC port directly, you tell SSH to forward a local port on your computer to port 5900 on the server. Your VNC client then connects to that local port. All traffic goes through the encrypted SSH tunnel.

Step 1: Create the SSH tunnel

Open Terminal on your local Mac and run:

ssh -L 12345:localhost:5900 your_username@your_server_ip

This maps port 12345 on your local machine to port 5900 on the server. You can pick any available local port, 12345 is just an example.

Leave this terminal session open. The tunnel stays active as long as the SSH connection is running.

Step 2: Connect with VNC

With the tunnel running, open Screen Sharing or any VNC client and connect to:

vnc://localhost:12345

On macOS you can also type this directly into Finder's Go> "Connect to Server" dialog (Cmd+K).

You are now connected to your server's desktop through the SSH tunnel.

Step 3: Block VNC in your firewall

Once you have confirmed the tunnel works, block port 5900 in your firewall so VNC is only reachable through SSH. See our guide Securing Your Mac Server with a Firewall for how to set that up.

Scope the block to your external interface. The tunnel terminates on the server and reaches Screen Sharing over loopback, so a rule that also covers lo0 will break it.

If you also restrict SSH (port 22) to your known IP addresses, your server's management interfaces are completely off the public internet.

Tips

The one-liner, explained. Two flags make the TL;DR command work:

  • -f backgrounds SSH after authentication. Without it, SSH sits in the foreground and the && never fires, because SSH has not exited yet.

  • ExitOnForwardFailure=yes makes SSH fail if port 12345 is already bound. Without it, SSH backgrounds itself happily and you connect to whatever stale tunnel is already listening.

sleep 10 is the cleanup mechanism. SSH exits when the remote command has finished and no forwarded connection is open. The ten seconds give Screen Sharing time to attach. Once it has, SSH stays up until you quit Screen Sharing, then exits on its own.

Tunnel with no shell. If you want a persistent tunnel and no interactive session, use -N instead of a remote command:

ssh -f -N -o ExitOnForwardFailure=yes -L 12345:localhost:5900 your_username@your_server_ip

This one never exits by itself. Kill it when you are done, or before opening a new tunnel on the same port:

pkill -f "12345:localhost:5900"

Key-based SSH auth. If you use SSH keys instead of passwords, the tunnel connects without a password prompt. This makes the workflow faster and more secure.

Windows and Linux. The same SSH tunnel approach works on any platform. On Windows, use PowerShell (the ssh command is built in) or a tool like PuTTY to set up the port forward. Then point your VNC client at localhost:12345.