I'm looking to route a port for VNC back to my house here. I have to jump over a single host to then hop to my actual work machine.

  • sittinghere will be my local home machine
  • hopper will by the intermediate hop I need to make
  • overthere will be the remote work machine

I can do this to SSH into my work machine:

ssh -t hopper "ssh -t overthere"

I'd like to use port forwarding to forward remote port 5900 on overthere to local port 5900 on sittinghere. However, I'd prefer to be able to do it without binding to a port openly on hopper as anyone on that machine would be able to attach to my VNC connection.

Is there any way for me to forward that port to my local machine securely with no one being able to get access to it on hopper?

  • What VNC client are you using?
    – slm
    Jul 5, 2014 at 1:58

6 Answers 6


Using SSH's native ability to forward ports. From sittinghere execute:

 ssh -v -N -L 5900:overthere:5900 user@hopper

Point your VNC client to localhost:5900 and the traffic will be tunneled to overthere:5900 through the SSH connection established on hopper

  • 2
    AFAIK, this solution won't help you if 5900 is only bound on the local ( interface, as the tunnel happens to hopper, and then hopper forwards all traffic to overthere:5900. If overthere:5900 is listening at or the given interface, then it'll work, but not if it's listening at Jul 30, 2015 at 0:43

I ended up using some SSH ~/.ssh/config hacks to make this happen:

Host hopper
    User naftuli
    ForwardAgent yes

Host overthere
    User naftuli
    ForwardAgent yes
    ProxyCommand ssh -q hopper nc overthere 22

What this does is that when I attempt to connect to ssh overthere from sittinghere, it connects to hopper and then proxies the SSH connection to port 22 on overthere (ie: SSH on overthere).

This has some awesome side-effects:

ssh -L 5900:localhost:5900 overthere "x11vnc -display :0 -localhost"

Everything works awesome and as far as I can tell, 5900 isn't opened on hopper, only forwarded directly from overthere to sittinghere.

  • Incidentally, I should have asked this in the comments before but the solution you stumbled into is right out of the x11nvc man page 8-). Sorry I didn't think to ask what VNC server you were using.
    – slm
    Jul 8, 2014 at 21:22
  • This scares the bejeezus out of me, but it definitely works! Jan 13, 2017 at 23:42
  • 1
    In some Linux distros (e.g. Ubuntu 14.04) netcat-openbsd is installed by default. In this case this hack may not work. To fix this problem you should firstly install netcat-traditional package (apt-get install netcat-traditional -y). Then you should to explicitly specify the nc type in the config file (by replacing nc with nc.traditional).
    – VeLKerr
    Aug 18, 2017 at 22:26
  • @Naftuli: Awesome indeed!
    – gone
    May 30, 2018 at 14:22
  • 1
    @AlexanderPozdneev netcat. Nov 21, 2018 at 21:11

You can forward a port from sittinghere to overthere's SSH port through hopper. Then you can use that port to reach overthere directly from sittinghere. In this second SSH session you can forward VNC or whatever other ports you like while hopper sees only an encrypted SSH session.

First SSH session:

ssh -f -N -L 7022:overthere:22 hopper

Now tell the SSH client how it can reach overthere by adding this config to ~/.ssh/config on sittinghere

Host overthere
    HostName hopper
    Port 7022
    HostKeyAlias overthere

Second SSH session:

ssh -f -N -L 5900:localhost:5900 overthere

Or just a regular interactive SSH session without the VNC port tunnel:

ssh overthere

If you don't want to bother adding lines to ~/.ssh/config you can still tell it how to connect to overthere from the command line:

ssh -p 7022 hopper

...but without the HostKeyAlias SSH will not verify overthere's key fingerprint correctly.

All command lines are to be run from sittinghere.

Incidentally, I think you probably don't need to be using ssh's -t option.


First connect hopper while making tunnel between worker and home pc.

ssh -f ismail@hopper -L 2222:overthere:22 -N

then make ssh ro overthere with vnc tunnel

ssh -p 2222 -f ismail@localhost -L 5900:localhost:5900

Now you can connect with vnc. By the way change configuration of vnc to listen localhost


If you're using the VNC client vncviewer from the command line you can use the -via switch to tell it to tunnel through a user@host prior to connecting to some other host's VNC server.


$ vncviewer -via user@host localhost:0

You can also use vinagre to connect via a SSH tunnel like so through the GUI. To do so set your connection up similar to this via the connection dialog in vinagre:

              ss #1

Which will result in your connection coming up, tunneled through the SSH tunnel host.

    ss #2



Following command also should work perfectly

ssh -f -N -J hopper overthere -L 5900:localhost:5900

It was tested with additional parameter to connect PostgreSQL server on postgres-server at customised port (-p switch) and also with using customised username.

ssh -f -N -J user1@jumphost -p 2222 user2@postgres-server -L 5432:localhost:5432

As you can see that solution is simple and doesn't require any configuration changes of ssh or any intermediate steps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .