That loopback limit catches my attention: a remote viewer cannot connect directly to the server’s public address because TigerVNC is limited to localhost. The SSH tunnel forwards viewer traffic to the server’s loopback address, while VNC stays on loopback.
The next step is to look at the session TigerVNC creates on Debian. That gives you a starting point for installing the server.
What a VNC server creates on Debian
Virtual Network Computing (VNC) lets a viewer display and control a desktop session running on another machine, while TigerVNC creates a separate virtual desktop rather than sharing the session already visible on the Debian console.
The server runs that desktop and sends screen updates over the Remote Framebuffer (RFB) protocol. A viewer connects to a numbered display such as :1, and the service manager associates that display with a Unix account.
| Part | Job in this setup |
|---|---|
| TigerVNC server | Creates the virtual desktop session |
| XFCE | Supplies the desktop session launched inside VNC |
| VNC viewer | Displays and controls the remote session |
| SSH tunnel | Forwards the viewer connection to the server’s loopback address |
What you need before installing TigerVNC
These commands target Debian 13 (trixie), the current stable release. Use a regular account with sudo access for administration, and use that same account for the VNC session rather than running the desktop as root.
- A Debian 13 server with working package repositories and SSH access.
- An installed desktop session. This procedure uses XFCE, whose session name is xfce. You can compare XFCE with KDE when choosing a desktop.
- A VNC viewer on the client computer.
If the server has no desktop, install XFCE along with TigerVNC. A desktop environment is not included in the VNC server package.
sudo apt update
sudo apt install xfce4 tigervnc-standalone-server tigervnc-tools
Install the server and command-line tools package, which provides the password utility. If a desktop is already installed, omit xfce4 and set the session name in the configuration to a matching file under /usr/share/xsessions.
For a quick package-manager refresher, see the difference between apt and apt-get.
Install and configure TigerVNC on Debian
Use this systemd service template when you want the VNC desktop to start with the system. Debian’s TigerVNC session manual describes the per-user session configuration and desktop selection.
Step 1: Select the XFCE desktop session
As the regular account that will own the session, create its TigerVNC configuration directory and open the per-user configuration file.
mkdir -p ~/.config/tigervnc
nano ~/.config/tigervnc/config.pl
Put these Perl assignments in the file. The session value must match a desktop file in /usr/share/xsessions, and localhost keeps the VNC listener reachable only from the server itself.
$session = "xfce";
$localhost = "yes";
$geometry = "1280x800";
Save the file, then set the VNC authentication password as this same user. The optional view-only password is separate and is not needed for interactive control.
tigervncpasswd
Step 2: Map display :1 to your account
Debian’s service reads its display-to-user assignments from /etc/tigervnc/vncserver.users. Open the file with sudo and add one mapping, replacing username with the regular account name that owns the configuration and password.
sudo nano /etc/tigervnc/vncserver.users
Add this mapping to the file:
:1=username
The colon identifies the virtual display, not a TCP port. TigerVNC uses port 5900 plus the display number, so display :1 corresponds to TCP port 5901.
Step 3: Enable and start the packaged service
Enable the instance so systemd starts it at boot, and start it now. The instance name includes the colon before the display number.
sudo systemctl enable --now tigervncserver@:1.service
systemctl status tigervncserver@:1.service --no-pager
Look for active (running) in the status output. If the service exits instead, read its journal before changing the display mapping or session configuration, using the Linux systemctl service commands as a reference.
Connect through an SSH tunnel
Because TigerVNC is limited to localhost, a remote viewer cannot connect directly to the server’s public address. Forward a local client port to port 5901 on the Debian server through SSH.
ssh -L 5901:localhost:5901 -N username@server_ip
Keep that SSH command running while you connect the VNC viewer. In a viewer that accepts display notation, enter localhost:1, which selects display :1 on the forwarded local port.
| Where | Address |
|---|---|
| SSH tunnel destination on the server | localhost:5901 |
| Address in a viewer that uses display notation | localhost:1 |
The SSH tunnel command listens on your computer and forwards traffic through SSH to the server’s loopback interface. You do not need to open port 5901 on the server firewall for this tunnel.
If SSH listens on a custom port, add its port option to the SSH command. The VNC destination remains localhost:5901 on the remote server. For details on changing that daemon port, see the Linux SSH port configuration steps.
Use the server’s reachable IP address in the SSH command. If you need help locating it, follow the Linux IP address steps.
Fix a VNC session that exits
A systemd unit can start and then exit when the session manager cannot launch the configured desktop or find a usable user session. Check the unit and its journal before editing the configuration.
systemctl status tigervncserver@:1.service --no-pager
journalctl -u tigervncserver@:1.service -b --no-pager
- Service cannot start a user session: confirm :1=username maps to an existing regular account.
- The session exits after launch: confirm xfce.desktop exists under /usr/share/xsessions and the config selects xfce.
- The viewer cannot reach the display: keep the SSH tunnel open and use localhost:1 in a viewer that accepts display notation.
- A direct network connection fails: that is expected with localhost enabled. Use SSH forwarding rather than exposing the VNC port.
Debian’s config.pl file uses Perl assignment syntax. A plain key=value setting belongs in the compatible config file, not in config.pl.
To confirm which XFCE desktop files are installed, list the available sessions:
ls /usr/share/xsessions/
Keep localhost enabled and use SSH forwarding to connect instead of exposing the VNC port to the network.
Keep the VNC listener on loopback
A VNC password does not make an exposed desktop port a good default. Keeping the listener on localhost and carrying viewer traffic through SSH gives the server one deliberate network path to the session.
systemctl is-active tigervncserver@:1.service
Once the service reports active, leave port 5901 closed to external clients and let the SSH tunnel carry the viewer connection.
Debian VNC server questions
Which port does TigerVNC use for display :1?
Display :1 normally maps to TCP port 5901 because TigerVNC adds the display number to port 5900. With localhost enabled, connect through an SSH tunnel and point the viewer at localhost:5901.
Does installing TigerVNC install a desktop environment?
No. Install a desktop environment such as XFCE separately, then set its session name in the TigerVNC configuration so the VNC session can launch it.
Does TigerVNC show the desktop already open on Debian?
This setup starts a separate virtual desktop session. It does not automatically share the physical console desktop that is already open on the machine.