Important: Complete the SSH setup before making this change
This configuration forces all Screen Sharing connections to use SSH, including connections from devices on the same local network.Once enabled, macOS will only accept direct Screen Sharing (VNC) connections originating from the Mac itself (localhost). Direct VNC connections from other devices will therefore stop working, whether they originate from the Internet, a VPN, or your local network.
Before proceeding, make sure Remote Login is enabled on your Mac and that Screens is configured to use Secure Connections, including Enable on Local Connections, as described below. Otherwise, Screens will not be able to connect.
Starting with macOS 10.12 Sierra, macOS can be configured so that its built-in Screen Sharing service only accepts connections originating from the Mac itself (localhost). This prevents other devices from connecting directly to the Screen Sharing (VNC) service, including devices on the same local network.
Screens can still connect by first establishing an SSH connection to the Mac and then tunneling the Screen Sharing connection through SSH. As a result, SSH becomes required for all Screens connections to that Mac, including local connections.
Before You Begin
Because direct Screen Sharing connections will no longer be accepted after making this change, Remote Login (SSH) must be enabled on your Mac.
- Open System Settings.
- Go to General > Sharing.
- Enable Remote Login.
- Make sure your Mac user account is allowed access.
You'll also need to configure Screens and Screens Connect, if installed, to use secure connections as described below.
Configure Screens
Before restricting Screen Sharing to local connections, edit your saved connection in Screens and open the Security section.
Enable Secure Connections and make sure Enable on Local Connections is also turned on.
This is important: once Screen Sharing is restricted to local connections, Screens must use SSH even when your device is on the same local network as your Mac.
Configure Screens Connect
If you use Screens Connect, open its settings, select General, and enable Use Remote Login.
This ensures that Screens Connect configures remote connections to use SSH instead of connecting directly to the Screen Sharing service.
Restrict Screen Sharing to Local Connections
Once Remote Login and the SSH options above are configured, open Terminal on the Mac and enter:
sudo defaults write /Library/Preferences/com.apple.RemoteManagement.plist VNCOnlyLocalConnections -bool yesEnter your Mac user account password when prompted.
The VNCOnlyLocalConnections setting instructs macOS Screen Sharing to accept direct VNC connections only from localhost.
This means:
- Direct VNC connections from the Internet will no longer work.
- Direct VNC connections through VPNs such as Tailscale or ZeroTier will no longer work.
- Direct VNC connections from other devices on your local network will no longer work.
- Screens must connect through SSH first and tunnel the VNC connection through it, regardless of whether the connection is remote or local.
Reverting the Change
If you want macOS Screen Sharing to accept network connections directly again, open Terminal and enter:
sudo defaults write /Library/Preferences/com.apple.RemoteManagement.plist VNCOnlyLocalConnections -bool noAllow a few seconds for macOS to apply the change before attempting to connect again.
Once the change takes effect, Screens can connect directly to the Screen Sharing (VNC) service again, including over your local network or a VPN, without requiring an SSH tunnel.
You can then disable the SSH-specific settings in Screens and Screens Connect if you no longer want to use secure connections.
Important: once Screen Sharing is restricted to localhost, Screens must use SSH for every connection to this Mac, even when your device is on the same local network or the Mac appears in Nearby.
Without Enable on Local Connections, local connections will attempt to connect directly to the VNC service and will fail.