On my local network, I can VNC-over-an-ssh-tunnel quite easily. I wish to do the same from abroad.
The server is set up to accept WAN-side ssh connections, and this works reliably. The problem is, when abroad I cannot start a successful VNC session over the ssh tunnel. A similar tunneling setup is used when I do the same on my LAN (which works perfect).
So "from over there," I can connect SSH, but when I try to connect VNC to 127.0.0.1, I get on UltraVNC:
Connection failed - End of stream Possible causes - Another user is already listening on this ID - Bad connection
...with whatever ports I may use.
Luckily TightVNC provides some level of logging. A failed connection is recorded as such:
[ 512/ 1904] 2015-03-22 10:33:34:617 : Initialization of socket stream and input/output gates... [ 512/ 1904] 2015-03-22 10:33:34:617 : Connection is established [ 512/ 1904] 2015-03-22 10:33:34:617 - Protocol stage is "Handshake". [ 512/ 1904] 2015-03-22 10:33:34:647 - onDisconnect: Connection has been gracefully closed [ 512/ 2060] 2015-03-22 10:33:35:719 - Process focus restoration in the RfbKeySym class [ 512/ 2060] 2015-03-22 10:33:35:719 - Process focus loss in the RfbKeySym class [ 512/ 2060] 2015-03-22 10:33:35:829 - Process focus restoration in the RfbKeySym class
And a successful one looks like this (from my LAN):
[ 7536/ 2900] 2015-03-22 11:22:28:892 : Initialization of socket stream and input/output gates... [ 7536/ 2900] 2015-03-22 11:22:28:892 : Connection is established [ 7536/ 2900] 2015-03-22 11:22:28:892 - Protocol stage is "Handshake". [ 7536/ 8032] 2015-03-22 11:22:28:946 client rect: 0, 0; 124, 31 [ 7536/ 8032] 2015-03-22 11:22:28:946 Desktop-window. (x, y): (0, 29); (w, h): (124, 2) [ 7536/ 2900] 2015-03-22 11:22:29:040 - Server sent protocol version: RFB 003.008 [ 7536/ 2900] 2015-03-22 11:22:29:040 - Send to server protocol version: RFB 003.008
After weeks of hair-pulling, different client attempts and trying whichever port-forwarding configuration I could think of (on either side's routers), I finally made a breakthrough.
I set up a second ssh tunnel in PuTTY - Dynamic at port 1080 (D1080). I then used a VNC client that allows a proxy connection, RealVNC VNC-Viewer, and pointed it at localhost port 1080 (type SOCKS 5).
THIS. WORKS. I am now sure my VNC session is secured, but only if I go through a local SOCKS proxy when I am abroad. The down side is I can not use my favorite client UltraVNC Viewer.
Also, I do not understand what is going on; I am looking for an explanation. Why doesn't the simple L5900 tunnel do the job from then WAN, when it does within the LAN?