Register for a trial of RealVNC Enterprise so that you can use direct connections instead of cloud-only connections. With only ports 80 and 443 to work with, forward port 443 to 5900 like so. If your VNC server is going to be on machine 192.168.0.108, for example, then make sure the 192.168.0.0/24 subnet is reachable from the gateway (typically the main router). Your vanity domain resolves to your gateway IP. Setup Port-Forwarding on the Gateway Router There are many guides on the net, but essentially install the DUC (DNS Update Client) somewhere on your LAN to periodically report your current external IP back to Noip so your chosen vanity domain name’s A-record points to your current gateway IP. I use a dynamic ISP IP and a VPN that also changes periodically so I need a dynamic DNS solution. You could skip this if you have a static IP at your gateway or ISP. This could be or DynDNS or any dynamic DNS provider. That is why inside my VMWare instance I’m using a 3rd-party VNC server daemon. A direct VNC connection may work for a while, but the firewall may be reactive and some WAF packet inspection rules may detect the tell-tale VNC packet headers and block the connection. I’m a huge fan of VMWare, and VMWare Desktop has built-in VNC functionality. Some machine on this LAN should have the Noip DUC (DNS Update Client) running to notify Noip if the gateway IP (or ISP IP) changes.

The vanity domain should resolve to the IP address of the gateway machine (or ISP IP) in front of the target VNC server.

You can do this by adding a CNAME entry pointing to a (likely) blocked Noip vanity domain you also control. You will establish a VNC connection using this uncommon domain name at port 443. The idea is to establish a direct VNC connection using a domain name you control so it shouldn’t be on any blocklist.

Target machine LAN gateway access (for port forwarding).

A domain with DNS control (for CNAME/ALIAS creation).

A free account (or a DNS provider with an API).

A RealVNC Enterprise trial account (30-days or US$55/yr).

If you only have available ports 80 and 443 for egress data and the firewall maintains a blocklist of common cloud-based VNC services, then this may help. Goal: Establish a direct, encrypted VNC connection to a remote VNC server through a restrictive firewall.

Vmware vnc connection