MobaXterm and Raspberry Pi: Unable to Connect to IPv6 VNC Host

Resolving MobaXterm IPv6 VNC connection failures on Raspberry Pi requires verifying that the VNC server is actively listening on an IPv6 address, ensuring firewall rules permit inbound traffic on port 5900, and correctly configuring MobaXterm’s SSH tunnel to handle IPv6 localhost bindings. The most common cause is a misconfigured tunnel or strict firewall settings blocking the specific IPv6 interface.

Verify VNC Server IPv6 Listening Status

Before troubleshooting the client side, you must confirm that the Raspberry Pi’s VNC server is actually bound to an IPv6 address. Many default configurations only bind to IPv4 (127.0.0.1 or 0.0.0.0). If the service is not listening on IPv6, no amount of client configuration will succeed. Open an SSH terminal to your Raspberry Pi and execute the following command to check active network connections:

sudo netstat -tlnp | grep vnc

Or, if you prefer modern tools:

ss -tlnp | grep vnc

Look for lines containing :: or specific IPv6 addresses in the "Local Address" column. You should see something like *:5900 or [::]:5900. If you only see 127.0.0.1:5900, your VNC server is restricted to IPv4 loopback. In this case, you need to adjust your VNC server configuration file (often located at /etc/vnc/config.d/custom or similar depending on the distro) to allow IPv6 binding. Refer to Connecting to Raspberry Pi's Wayland VNC Server with TightVNC 2.8 for detailed steps on configuring VNC servers on modern Raspberry Pi OS versions. If the server is listening on IPv6, proceed to check your firewall settings.

Configure Firewall Rules for IPv6 Traffic

Firewalls are a frequent culprit for silent drops in IPv6 connectivity. Unlike IPv4, where users often rely on iptables, IPv6 uses ip6tables or higher-level tools like ufw (Uncomplicated Firewall). Assuming you are using UFW, which is standard on Raspberry Pi OS, you must explicitly allow IPv6 traffic. Check your current UFW status by running:

sudo ufw status verbose

If the status shows "active," ensure that rule for port 5900 (VNC) allows both IPv4 and IPv6. By default, UFW may only create IPv4 rules. To fix this, delete any existing incorrect rules for VNC and recreate them to be protocol-agnostic or explicitly include IPv6. First, remove old rules if they exist:

sudo ufw delete allow 5900

Then, add a new rule that applies to all protocols:

sudo ufw allow 5900

UFW handles IPv6 automatically if enabled in its configuration. Verify that /etc/default/ufw has IPV6=yes. If it is set to no, change it to yes and restart the firewall:

sudo systemctl restart ufw

This ensures that incoming connections on port 5900 are permitted regardless of whether the source IP is IPv4 or IPv6. For more context on public IPv6 setup, see Set Up Public IPv6 on Ubuntu Server 22.04 and Raspberry Pi: A Beginner's Guide.

Correctly Configure MobaXterm SSH Tunnel

MobaXterm simplifies remote access by creating SSH tunnels automatically, but its handling of IPv6 localhost bindings can be tricky. The previous error regarding localhost:[::]:port syntax suggests confusion about how MobaXterm maps local ports to remote services. In MobaXterm, when you edit your SSH session profile: 1. Go to the Advanced SSH Settings tab. 2. Enable X11 forwarding if needed, but focus on Port Forwarding. 3. Add a new port forward entry. Set the Local port to an available port on your Windows machine (e.g., 5901). 4. Set the Remote host to localhost or [::1]. Using [::1] explicitly targets the IPv6 loopback address, which is safer than plain localhost if your system resolves localhost to IPv4 first. 5. Set the Remote port to 5900 (or whatever port your VNC server uses). The critical distinction is that MobaXterm creates a listener on your local machine. When you connect to localhost:5901 in MobaXterm’s internal VNC viewer, it sends the data through the SSH tunnel to the Raspberry Pi. The Raspberry Pi then connects to its own VNC server via IPv6. If you are connecting directly to the VNC server without an SSH tunnel (not recommended for security), ensure your MobaXterm VNC viewer input field contains the actual IPv6 address of the Pi, enclosed in square brackets, like [2001:db8::1]:5900. However, using an SSH tunnel is the robust solution described in How to route vnc traffic over ssh tunnel?.

Test Connectivity and Troubleshoot

Once the server is listening and the firewall allows traffic, test the connection from the Raspberry Pi itself to ensure local IPv6 connectivity works. Use the ping command with the -6 flag to verify IPv6 reachability:

ping -6 ::1

If this fails, your Pi may not have an IPv6 link-local address configured properly. Check your network interfaces with:

ip -6 addr show

Ensure you have a valid fe80:: (link-local) or global unicast address. If you lack IPv6 connectivity entirely, you cannot connect to an IPv6 VNC host. Finally, in MobaXterm, try connecting to the VNC server via the tunnel. If it hangs, check the MobaXterm log window for errors. Common issues include: - The remote host resolving to IPv4 instead of IPv6. - The VNC server requiring authentication that isn’t being passed correctly through the tunnel. - Network segmentation preventing IPv6 communication between your PC and the Pi. By systematically verifying the server binding, firewall permissions, and tunnel configuration, you can reliably establish IPv6 VNC sessions from MobaXterm to your Raspberry Pi.

Frequently Asked Questions

Why does my VNC connection time out even though the firewall is open?

A timeout usually indicates that packets are being dropped somewhere along the path, often due to intermediate routers blocking IPv6 traffic. Ensure that your router supports IPv6 and that the Pi is assigned a valid global IPv6 address, not just a link-local one. Link-local addresses cannot be routed across subnets.

Can I use IPv4 localhost in the MobaXterm tunnel for an IPv6 remote server?

No, the remote end of the SSH tunnel must match the protocol of the target service. If your VNC server listens on IPv6 ([::]:5900), the SSH tunnel must also terminate on an IPv6 interface. Using 127.0.0.1 as the remote host will fail because the VNC server is not listening on IPv4.

How do I find the correct IPv6 address of my Raspberry Pi?

Run ip -6 addr show on the Pi. Look for the address associated with your active network interface (usually eth0 or wlan0). Avoid using fe80:: addresses for remote connections as they are only valid on the local link. Use the global unicast address starting with 2001: or 2600:.

Is it safe to expose VNC over IPv6 without a tunnel?

No, VNC transmits data including keystrokes in plaintext. Exposing it directly to the internet via IPv6 is highly insecure. Always use an SSH tunnel or a VPN to encrypt the connection. This protects against eavesdropping and unauthorized access.

What if MobaXterm says "Connection refused"?

This error means the TCP handshake reached the destination but no application accepted the connection. Verify that the VNC server process is running and actively listening on the specified port. Use netstat or ss on the Pi to confirm the service is up and bound to the correct address.