VNC users can also tell the Windows firewall to only respond to a specific range of IP addresses.

I do that even if a VPN is used