There are many good answers on how to tunnel VNC traffic using SSH. When doing something like...
ssh user@host -L 5900:localhost:5900 x11vnc
...you can connect to the SSH tunnel on localhost:5900 (on the client side) to the SSH. But isn't host:5900 also open for attackers? How can I make x11vnc listening only to the traffic comming from the SSH tunnel?
I'd prefer something temporary and not messing around with iptables or so.
I think the
-listen parameter is not what I need, because it listens to the interface with the given IP address:
-listen ipaddr listen for connections only on network interface with addr ipaddr. '-listen localhost' and hostname work too.
...copied from here.