How do I set up an encrypted SSH tunnel for VNC?

Question

Here's whats happening:

The TightVNC client on my Windows client does not interact with my Vino VNC server, because of some encryption stuff, as shown here: Gnome 3.10 sharing desktop --- how to configure the security type for VNC? . Therefore, I wanted to create an SSH tunnel. But I have no idea how to do it. Could you guide me?

Here's how I wanted it to be set up:

My desktop, running Ubuntu GNOME, with the default Vino VNC server, can be accessed remotely through VNC, but with the (enabled by default) encryption turned OFF. However, on my Windows laptop, I want to be able to access the VNC Server using the VNC client TightVNC, with all the connections happening between them going through an encrypted SSH Tunnel.

Answer 1

If the IP address of your VNC server is 1.2.3.4 (and running on the standard port), you might execute:

ssh -L 5959:127.0.0.1:5900 user@1.2.3.4

This sets up an encrypted tunnel from your local machine's port 5959 that magically comes out on port 5900 at 1.2.3.4

Then you can VNC to localhost::5959

The above assumes that you're also running VNC on your local machine, so port 5900 is taken; 5959 is just another port. If port 5900 is free, you can change the 5959 in the ssh line to 5900 and just connect VNC to localhost (127.0.0.1) without specifying a port.

Note that your VNC server must be configured to accept loopback connections; some reject them by default to keep someone from VNCing to themselves and starting an infinite stream of cascading windows.

Answer 2

Before connecting with VNC, I use a Putty client (https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html) to create an SSH connection from my Windows laptop to the remote linux server, and set up the tunnel using this.

I leave this ssh session running while VNC is running so that the tunnel stays up.

Before the Putty connection is opened, while you are configuring it, you will find a menu item under the Category list on the left hand side of the Putty client configuration options called "Connection" with a sub-menu item called "ssh" and under this, a further sub-menu item called "Tunnels".

On this options page, configure the local (source) port as 127.0.0.1:5021 and the remote port as the hostname or IP address of your server, and the remote port that your vncserver on the linux host is listening on. Save the Putty session using a handy nickname. Open the session and log in on your linux server. This creates the tunnel.

Now open your VNC Windows application and ask it to connect to 127.0.0.1:5021 - and it will use the tunnel that you've set up. Note that you're connecting to a VNC port on your local machine, which appears to be on your remote machine, and note also that on the remote machine, your firewall rules may need amending to allow local traffic on the port advertised by the VNC server, but there is no need to ensure that your network card interface allows traffic on that port, because it is being tunneled over port 22 (your ssh connection). Cheers, Jerry