Index: src/VBox/Frontends/VBoxHeadless/FramebufferVNC.h
===================================================================
--- src/VBox/Frontends/VBoxHeadless/FramebufferVNC.h	(revision 39122)
+++ src/VBox/Frontends/VBoxHeadless/FramebufferVNC.h	(working copy)
@@ -33,7 +33,7 @@
 class VNCFB : VBOX_SCRIPTABLE_IMPL(IFramebuffer)
 {
 public:
-    VNCFB(ComPtr <IConsole> console, int port, char const *password);
+    VNCFB(ComPtr <IConsole> console, int port, char const *password, char const *address);
     virtual ~VNCFB();
 
 #ifndef VBOX_WITH_XPCOM
@@ -94,6 +94,7 @@
     uint8_t *mScreenBuffer;
 
     int mVncPort;
+    char const *mVncAddress;
 
     ComPtr<IConsole> mConsole;
     ComPtr<IKeyboard> mKeyboard;
Index: src/VBox/Frontends/VBoxHeadless/VBoxHeadless.cpp
===================================================================
--- src/VBox/Frontends/VBoxHeadless/VBoxHeadless.cpp	(revision 39122)
+++ src/VBox/Frontends/VBoxHeadless/VBoxHeadless.cpp	(working copy)
@@ -476,6 +476,7 @@
 #ifdef VBOX_WITH_VNC
              "   -n, --vnc                             Enable the built in VNC server\n"
              "   -m, --vncport <port>                  TCP port number to use for the VNC server\n"
+             "   -q, --vncaddress <ipaddr>             IP address or host name to use for the VNC server\n"
              "   -o, --vncpass <pw>                    Set the VNC server password\n"
 #endif
              "   -v, -vrde, --vrde on|off|config       Enable (default) or disable the VRDE\n"
@@ -562,6 +563,7 @@
 #ifdef VBOX_WITH_VNC
     bool        fVNCEnable      = false;
     unsigned    uVNCPort        = 0;          /* default port */
+    char const *pszVNCAddress   = NULL;       /* bind to all interfaces */
     char const *pszVNCPassword  = NULL;       /* no password */
 #endif
     unsigned fRawR0 = ~0U;
@@ -616,6 +618,7 @@
         { "--vrdeproperty", 'e', RTGETOPT_REQ_STRING },
 #ifdef VBOX_WITH_VNC
         { "--vncport", 'm', RTGETOPT_REQ_INT32 },
+        { "--vncaddress", 'q', RTGETOPT_REQ_STRING },
         { "--vncpass", 'o', RTGETOPT_REQ_STRING },
         { "--vnc", 'n', 0 },
 #endif /* VBOX_WITH_VNC */
@@ -685,6 +688,9 @@
             case 'm':
                 uVNCPort = ValueUnion.i32;
                 break;
+            case 'q':
+                pszVNCAddress = ValueUnion.psz;
+                break;
             case 'o':
                 pszVNCPassword = ValueUnion.psz;
                 break;
@@ -920,7 +926,7 @@
         {
             Bstr machineName;
             machine->COMGETTER(Name)(machineName.asOutParam());
-            g_pFramebufferVNC = new VNCFB(console, uVNCPort, pszVNCPassword);
+            g_pFramebufferVNC = new VNCFB(console, uVNCPort, pszVNCPassword, pszVNCAddress);
             rc = g_pFramebufferVNC->init(machineName.raw() ? Utf8Str(machineName.raw()).c_str() : "");
             if (rc != S_OK)
             {
Index: src/VBox/Frontends/VBoxHeadless/FramebufferVNC.cpp
===================================================================
--- src/VBox/Frontends/VBoxHeadless/FramebufferVNC.cpp	(revision 39122)
+++ src/VBox/Frontends/VBoxHeadless/FramebufferVNC.cpp	(working copy)
@@ -40,13 +40,14 @@
  * buffer to 0 so that RequestResize() does not free it the first time
  * it is called.
  */
-VNCFB::VNCFB(ComPtr <IConsole> console, int port, const char *password) :
+VNCFB::VNCFB(ComPtr <IConsole> console, int port, const char *password, const char *address) :
     mPixelFormat(FramebufferPixelFormat_Opaque),
     mBitsPerPixel(0),
     mBytesPerLine(0),
     mRGBBuffer(0),
     mScreenBuffer(0),
     mVncPort(port),
+    mVncAddress(address),
     mConsole(console),
     mKeyboard(0),
     mMouse(0),
@@ -90,6 +91,9 @@
     vncServer->screenData = (void*)this;
     if (mVncPort)
         vncServer->port = mVncPort;
+    if (mVncAddress)
+        if (!rfbStringToAddr(mVncAddress, &(vncServer->listenInterface)))
+            RTPrintf("Warning: could not parse VNC server listen address!\n");
     char *pszDesktopName;
     rc = RTStrAPrintf(&pszDesktopName, "%s - VirtualBox", pszName);
     if (rc >= 0)
