Setting Up VNC Access to Raspberry Pi via AWS EC2 and a Custom Domain

Why Do You Need VNC?

What You’ll Get After Setup:

Terminology Explained in Simple Terms

Before we start, let’s clear up what all these technical terms mean. Don’t worry if you forget something — we’ll revisit each term as we go through the setup process.

How It Works: The Path from You to Raspberry Pi

Let’s break down how data travels between your computer and your Raspberry Pi. Understanding the flow will help you troubleshoot issues later.

Step-by-Step Explanation:

What You’ll Need

Before we begin, make sure you have everything ready. If you’re missing something, take a moment to set it up first.

Quick Reference: Values You’ll Need

Keep this info handy. In examples, we’ll use placeholders — replace them with your real values.

Step 1. Checking VNC on Raspberry Pi

VNC Server comes pre-installed on Raspberry Pi OS and usually starts automatically. Let’s make sure it’s running and see which port it’s listening on.

1.1 Connect to Your Raspberry Pi

Open a terminal on your computer and run:

1ssh rpi

1.2 Check the VNC Port

On your Raspberry Pi, run this command:

1sudo ss -tulpn | grep 590

Expected output (example):

1tcp   LISTEN   0   5   0.0.0.0:5900   0.0.0.0:*   users:(("vncserver-x11",pid=1234))

1sudo systemctl status vncserver-x11-serviced.service

1sudo systemctl enable vncserver-x11-serviced.service
2sudo systemctl start vncserver-x11-serviced.service

1sudo systemctl status vncserver-x11-serviced.service

Perfect! VNC is running. Keep the terminal open — we’re moving to the next step.

Step 2. Adding VNC to the SSH Tunnel

Right now, your SSH tunnel only forwards SSH traffic (port 22). We’ll extend it to include VNC, so you can access your Raspberry Pi’s desktop remotely.

2.1 Stop the Tunnel

On your Raspberry Pi (inside the SSH session), run:

1sudo systemctl stop reverse-tunnel.service

2.2 Edit the Tunnel Configuration

Open the service configuration file:

1sudo vim /etc/systemd/system/reverse-tunnel.service

2.3 Find and Modify ExecStart Line

Locate the line starting with ExecStart=. It’s long — just append a new parameter at the end.

Before (old version):

1ExecStart=/usr/bin/ssh -i /home/a528fe1/.ssh/id_tunnel ... -R 2222:localhost:22 tunnel@YOUR-EC2-IP

After (new version):

1ExecStart=/usr/bin/ssh -i /home/a528fe1/.ssh/id_tunnel ... -R 2222:localhost:22 -R 5901:localhost:5900 tunnel@YOUR-EC2-IP

2.4 Save the Changes

In vim:

1. Press Esc
2. Type :wq
3. Press Enter

File saved successfully!

2.5 Reload and Start the Tunnel

Run these commands in order:

1# Reload systemd configs
2sudo systemctl daemon-reload
3
4# Start the tunnel with new settings
5sudo systemctl start reverse-tunnel.service
6
7# Check status
8sudo systemctl status reverse-tunnel.service

What to look for in the output:

2.6 Verify the Tunnel Includes VNC

Let’s confirm the SSH process is actually forwarding port 5901:

1ps aux | grep ssh | grep tunnel

You should see a line like this:

1a528fe1  12345  ... /usr/bin/ssh ... -R 2222:localhost:22 -R 5901:localhost:5900 tunnel@YOUR-EC2-IP

Don’t close the terminal, but you can safely exit Raspberry Pi:

1exit

Step 3. Checking on the EC2 Server

Now let’s verify that the tunnel has reached the EC2 server and that port 5901 is open for connections.

3.1 Connect to Your EC2 Instance

In your computer’s terminal, run:

1ssh -i ~/.ssh/rpi-tunnel-key.pem ubuntu@YOUR-EC2-IP

3.2 Check Tunnel Ports

On EC2, run:

1sudo ss -tulpn | grep -E "2222|5901"

You should see one of these two cases:

1tcp   LISTEN   0   128   127.0.0.1:2222   0.0.0.0:*   users:(("sshd",pid=...))
2tcp   LISTEN   0   128   127.0.0.1:5901   0.0.0.0:*   users:(("sshd",pid=...))

1tcp   LISTEN   0   128   0.0.0.0:2222   0.0.0.0:*   users:(("sshd",pid=...))
2tcp   LISTEN   0   128   0.0.0.0:5901   0.0.0.0:*   users:(("sshd",pid=...))

3.3 Enable GatewayPorts (if needed)

Check the current setting:

1sudo grep -i gatewayports /etc/ssh/sshd_config

You should see:

1GatewayPorts yes

If the line is commented out (#GatewayPorts) or missing entirely:

1. Open the file: sudo vim /etc/ssh/sshd_config
2. Find the GatewayPorts line or add it to the end
3. Set it to: GatewayPorts yes
4. Save with: Esc, :wq, Enter

Restart the SSH service:

1sudo systemctl restart ssh

Don’t worry — this won’t disconnect your current SSH session.

3.4 Restart the Tunnel on Raspberry Pi

After making changes on EC2, restart the tunnel on your Raspberry Pi. Without closing the EC2 terminal, open a new terminal and run:

1ssh rpi
2sudo systemctl restart reverse-tunnel.service
3exit

3.5 Check Ports Again on EC2

Back in your EC2 terminal, verify again:

1sudo ss -tulpn | grep -E "2222|5901"

3.6 Test Local Connection

Let’s check if port 5901 is responding locally on EC2:

1nc -zv localhost 5901

Expected output:

1Connection to localhost 5901 port [tcp/*] succeeded!

Exit EC2:

1exit

Step 4. Opening the Port in AWS Security Group

A Security Group is the virtual firewall for your EC2 instance. Right now, port 5901 is closed to the Internet. Let’s open it so you can connect to VNC from anywhere.

4.1 Open AWS Console

1. Go to AWS Console
2. Sign in to your account
3. Select the region where your EC2 instance runs (for example Frankfurt — eu-central-1)
4. Open Services → EC2

4.2 Find the Security Group

1. In the left menu, click Instances
2. Find and select your instance (for example rpi-tunnel-server)
3. A details panel opens below
4. Switch to the Security tab
5. Click the Security Group name (for example sg-1234567890abcdef0)

4.3 Add a Rule for VNC

1. Click Edit inbound rules
2. Click Add rule
3. Fill in the fields:
   • Type: Custom TCP
   • Port range: 5901
   • Source: choose one of:
     • 0.0.0.0/0 — access from anywhere (convenient but less secure)
     • My IP — access only from your current IP (more secure)
   • Description: VNC access to Raspberry Pi
4. Click Save rules

4.4 Verify All Rules

In the Inbound rules list you should see at least the following entries:

Step 5. Verifying Your Domain

You can connect using your EC2 IP, but it’s easier to remember a domain name likemy-rpi.ddns.net or home-pi.example.com. Let’s verify that your domain correctly points to your EC2 server.

5.1 Check DNS Record

You need an A record in your DNS zone pointing to your EC2 IP address.

You can set this up in your DNS provider’s panel (Cloudflare, Namecheap, Route53, etc.). If you use Dynamic DNS (like DuckDNS or No-IP), the record is created automatically.

5.2 Test Domain Resolution

On your computer, check that the domain resolves to your EC2 IP:

1nslookup my-rpi.ddns.net

Expected output:

1Name:   my-rpi.ddns.net
2Address: 18.185.123.45

5.3 Optional: Verify Through Browser

Open your browser and visit http://my-rpi.ddns.net:5901. You’ll likely see a “Connection refused” or “Invalid response” message — that’s good!

Great — your domain is now verified. Next, let’s install a VNC client and actually connect to your Raspberry Pi.

Step 6. Installing VNC Viewer

Now that the tunnel and domain are configured, it’s time to install the program you’ll use to access your Raspberry Pi’s desktop.

6.1 Download VNC Viewer

Go to https://www.realvnc.com/en/connect/download/viewer/ and choose the version for your system.

6.2 Install the Application

Follow the on-screen installer instructions. No special configuration is required — the default options are fine.

6.3 Launch VNC Viewer

After installation, open the app. You’ll see an empty window with an address bar at the top.

6.4 Enter Connection Address

In the address field, enter your EC2 public IP or domain name followed by :5901:

1my-rpi.ddns.net:5901

Press Enter — a dialog will appear asking for your Raspberry Pi’s VNC password.

That’s it — your VNC connection through AWS EC2 is ready! In the next step, we’ll test and troubleshoot the setup.

Step 7. Connect via VNC! 🎉

Everything’s ready! You’re about to see your Raspberry Pi desktop remotely for the first time. It’ll only take a minute.

7.1 Launch VNC Viewer

Open the VNC Viewer application on your computer.

7.2 Enter the Connection Address

At the top of the VNC Viewer window you’ll see an address field.

If you have a domain, type:

1YOUR-DOMAIN.example.com:5901

Or use your IP address directly:

1YOUR-EC2-IP:5901

7.3 (Optional) Save the Connection

To avoid typing the address every time, you can save it:

1. Click File → New connection
2. In VNC Server, enter YOUR-DOMAIN.example.com:5901
3. In Name, give it a friendly label like Raspberry Pi Home
4. Leave all other fields at their default values
5. Click OK

The connection is now saved — next time, simply double-click it to connect.

7.4 Connect

Press Enter or double-click the saved connection.

7.5 Security Warning (First Time Only)

You might see a warning window:

Click Continue or Connect.

7.6 Enter the VNC Password

An Authentication dialog will appear asking for your password.

Enter the password and click OK.

7.7 Success — You’re In! 🎉

Extra Security Options

The setup you’ve built is already quite secure — traffic goes through an SSH tunnel and isn’t exposed to the public Internet. But if you want to tighten it even more, here are several additional layers you can add.

1sudo raspi-config → Interface Options → SSH → Enable
2sudo nano /etc/ssh/sshd_config
3# Set:
4PasswordAuthentication no

1sudo apt update
2sudo apt install fail2ban
3sudo systemctl enable --now fail2ban

1sudo apt install cloudflared
2cloudflared tunnel login
3cloudflared tunnel create rpi-vnc
4cloudflared tunnel route dns rpi-vnc my-rpi.example.com

These steps are optional but highly recommended if you plan to leave your Pi online permanently.

Troubleshooting

If something doesn’t work as expected, don’t worry. Here are the most common issues and how to fix them step by step.

1sudo systemctl status reverse-tunnel.service

1sudo systemctl restart reverse-tunnel.service

1sudo ss -tulpn | grep 5901

1sudo systemctl enable reverse-tunnel.service

1sudo reboot

1sudo systemctl get-default

1sudo systemctl set-default graphical.target
2sudo reboot

1sudo systemctl restart ssh

1# Check if the tunnel is active
2sudo systemctl status reverse-tunnel.service
3
4# View system logs
5journalctl -u reverse-tunnel.service -n 30
6
7# Check network sockets
8sudo ss -tulpn | grep ssh
9
10# Test connection from EC2
11nc -zv localhost 5901

Useful Commands

Here’s a quick reference of all the main commands used in this guide — organized by where you run them. Save this list for later.

1# Check VNC port
2sudo ss -tulpn | grep 590
3
4# Restart VNC server
5sudo systemctl restart vncserver-x11-serviced.service
6
7# Check tunnel status
8sudo systemctl status reverse-tunnel.service
9
10# Restart tunnel
11sudo systemctl restart reverse-tunnel.service
12
13# Enable tunnel on boot
14sudo systemctl enable reverse-tunnel.service

1# Check listening ports
2sudo ss -tulpn | grep -E "2222|5901"
3
4# Restart SSH if GatewayPorts changed
5sudo systemctl restart ssh
6
7# Check VNC port locally
8nc -zv localhost 5901

1# Test EC2 port from your machine
2nc -zv YOUR-EC2-IP 5901
3
4# Connect to Raspberry Pi via tunnel
5ssh rpi
6
7# Connect to EC2 server
8ssh -i ~/.ssh/rpi-tunnel-key.pem ubuntu@YOUR-EC2-IP

That’s it — you’ve completed the full setup! Your Raspberry Pi is now accessible from anywhere via a secure and private VNC connection.

What’s Next?

Now that you have full remote access, your Raspberry Pi can serve as the foundation for countless creative and practical projects:

Useful Links