Connectivity
RealVNC uses the RFB protocol. It defaults to TCP port 5900. When making a connection over the internet, the user must open this port in the local firewall as well as configure port forwarding to forward TCP Port 5900 (or the customized port respectively) to the local machine address if behind a NAT Router.
As an alternative, one can tunnel VNC through SSH, avoiding the opening of additional ports and automatically traversing the NAT router. SSH also provides encryption of the connection between the VNC server and viewer.
Read more about this topic: RealVNC