I only added 0.0.0.0/0.0.0.0 as an act of desperation, the access list has the correct IP and mask of the client. I can remove or add it, it makes no difference. Unlike the OP, I always launched it from the network-startup with "Run >NIL:", so in theory I'm doing everything by the books. This all used to work a couple of updates ago, so I'm really lost about what changed. That's why I thought maybe there's a log I can check to see if VNCServer receives any incoming connection at all. I tried TightVNC instead of RealVNC, but it times out as well.