HTTPfy

Port 5901 (VNC display :1)

Second VNC display; the default for many Linux VNC servers started with vncserver :1.

Registered (user) port, 1024-49151 TCP Remote access Expose only to trusted sources

What port 5901 is used for

Second VNC display; the default for many Linux VNC servers started with vncserver :1.

Security: should port 5901 be open?

Expose only to trusted sources. Same as 5900: tunnel through SSH or a VPN.

IANA assignment

Port 5901 is in the registered range and has no IANA assignment. The usage above is unofficial but widespread.

Check what is listening on port 5901

Linux: is anything listening on TCP 5901?
sudo ss -tlnp 'sport = :5901'
Linux / macOS: which process owns the port
sudo lsof -nP -i :5901
Older Linux / BSD (net-tools)
sudo netstat -tlnp | grep ':5901 '
Windows (Command Prompt)
netstat -ano | findstr :5901
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 5901 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine
nc -vz -w 5 HOST 5901
From Windows
Test-NetConnection HOST -Port 5901

Allow only trusted sources on port 5901 in the firewall

Replace 203.0.113.10 with the address or network you trust. With ufw, make sure the default incoming policy is deny.

ufw (one trusted source)
sudo ufw allow from 203.0.113.10 to any port 5901 proto tcp
iptables
sudo iptables -A INPUT -p tcp --dport 5901 -s 203.0.113.10 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 5901 -j DROP
nftables
sudo nft add rule inet filter input ip saddr 203.0.113.10 tcp dport 5901 accept
sudo nft add rule inet filter input tcp dport 5901 drop
Windows Firewall
New-NetFirewallRule -DisplayName 'TCP 5901 trusted' -Direction Inbound -Protocol TCP -LocalPort 5901 -RemoteAddress 203.0.113.10 -Action Allow

Related ports

5900VNC5800VNC over HTTP22SSH5883jute5903ff-ice5904ag-swim5905asmgcs

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.