# VNC (/manage/resources/public/vnc)

> View and control a remote display through a VNC client rendered in the browser



VNC public resources render a full VNC client in the browser. Users visit a FQDN, complete Pangolin authentication, and get an interactive remote display session without installing a VNC viewer.

## Benefits [#benefits]

* Users get a remote display from any browser, with no VNC viewer or Pangolin client to install.
* The VNC server is never exposed to the internet. Pangolin authentication happens before a session can start.
* SSO, identity providers, and access rules protect VNC servers that often have weak or no passwords of their own.
* Works with Linux desktops, macOS screen sharing, and embedded devices that expose a VNC server.

## Use Cases [#use-cases]

* Remotely support a Linux or macOS desktop.
* Reach the display of a kiosk, digital sign, or industrial HMI panel behind NAT.
* Get console access to a virtual machine whose hypervisor exposes VNC.

## How It Works [#how-it-works]

1. You assign a FQDN on a domain managed in Pangolin.
2. The user completes [authentication and access rules](/manage/resources/public/authentication) in the browser.
3. Pangolin renders the VNC session and proxies traffic to the VNC server through a site connector.

No Pangolin client is required.

## Video Walkthrough [#video-walkthrough]

<iframe className="w-full aspect-video rounded-xl" src="https://www.youtube-nocookie.com/embed/4Yb5SpHaMRs" title="How To Setup VNC In The Browser With Pangolin" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerPolicy="strict-origin-when-cross-origin" />

## Site and Host Configuration [#site-and-host-configuration]

VNC public resources do **not** use [targets](/manage/resources/public/targets). Instead, you:

1. Select which sites can route to the resource.
2. Enter the backend VNC server host and port (commonly `5900` or `5900 + display number`).

Pangolin routes through the site that is online and healthiest, using the same intelligent multi-site routing model as [private resources](/manage/resources/private/multi-site-routing).

## Authentication and Access Rules [#authentication-and-access-rules]

VNC public resources are protocol-aware and support the full set of Pangolin [authentication and access rules](/manage/resources/public/authentication), including platform SSO, identity providers, user/role assignments, and context-based allow/deny rules. You can share these settings across resources with a [resource policy](/manage/resources/public/resource-policies).

VNC session credentials (if configured on the VNC server) are entered in the browser-rendered client after Pangolin authentication succeeds.