Before connecting with VNC, I use a Putty client (https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html) to create an SSH connection from my Windows laptop to the remote linux server, and set up the tunnel using this.
I leave this ssh session running while VNC is running so that the tunnel stays up.
Before the Putty connection is opened, while you are configuring it, you will find a menu item under the Category list on the left hand side of the Putty client configuration options called "Connection" with a sub-menu item called "ssh" and under this, a further sub-menu item called "Tunnels".
On this options page, configure the local (source) port as 127.0.0.1:5021 and the remote port as the hostname or IP address of your server, and the remote port that your vncserver on the linux host is listening on. Save the Putty session using a handy nickname. Open the session and log in on your linux server. This creates the tunnel.
Now open your VNC Windows application and ask it to connect to 127.0.0.1:5021 - and it will use the tunnel that you've set up. Note that you're connecting to a VNC port on your local machine, which appears to be on your remote machine, and note also that on the remote machine, your firewall rules may need amending to allow local traffic on the port advertised by the VNC server, but there is no need to ensure that your network card interface allows traffic on that port, because it is being tunneled over port 22 (your ssh connection). Cheers, Jerry