Consider three machines in this scenario:

  1. Machine_A: my local home MacBook
  2. Machine_B: some server I can ssh directly without vpn from Machine A. (remote jump-server)
  3. Machine_C: Firewall protected machine only accessible by/through Machine_B. (remote protected localhost)

Ultimately, I want to start VNCserver on Machine_C and view it on Machine_A.

I figured out how to run VNCserver on Machine_C by running for example: vncserver :4. As of now, the vncviewer works perfectly fine but I have to do TWO STEP process to enable the port forwarding such that vncviewer successfully works:

  1. On my Machine_A terminal, I run: ssh -L 5904:localhost:5904 myusername@Machine_B
  2. from step 1, I am now ssh’ed into Machine_B. Now, in Machine_B I run: ssh-L 5904:localhost:5904 Machine_C

Once these TWO STEPS are working fine, my vncviewer runs fine showing up Machine_C's vncsession by typing localhost:4 in vncviewer.

However, I have to follow TWO STEP process. I recall the ONE command process shown below

ssh -L 5904:Machine_C:5904 myusername@Machine_B

should do the work but is not working for me and shows me this debugged response:

debug1: Connection to port 5904 forwarding to Machine_C port 5904 requested.
debug2: fd 12 setting TCP_NODELAY
debug1: channel 3: new [direct-tcpip]
channel 3: open failed: connect failed: Connection refused
debug2: channel 3: zombie
debug2: channel 3: garbage collecting
debug1: channel 3: free: direct-tcpip: listening port 5904 for Machine_C port 5904, connect from ::1 port 61702 to ::1 port 5904, nchannels 4

For reference:

My ~/.ssh/config file on both Machine_B and Machine_C:

Host *
     ForwardAgent yes
     ForwardX11 yes
     ForwardX11Trusted yes
     RhostsAuthentication yes
     RhostsRSAAuthentication yes
     RSAAuthentication yes
     TISAuthentication no
     PasswordAuthentication yes
     FallBackToRsh yes
     UseRsh no
     BatchMode no
     StrictHostKeyChecking no
     IdentityFile ~/.ssh/identity
     Port 22
     EscapeChar ~

My ~/.vnc/xstartup file setting on both Machine_B and Machine_C:


# Uncomment the following two lines for normal desktop:
exec /etc/X11/xinit/xinitrc

[ -x /etc/vnc/xstartup ] && exec /etc/vnc/xstartup
[ -r $HOME/.Xresources ] && xrdb $HOME/.Xresources
xsetroot -solid grey
vncconfig -iconic &
/usr/bin/gnome-session --session=2d-gnome &
xterm -geometry 80x24+10+10 -ls -title "$VNCDESKTOP Desktop" &
#twm &
#startx &i
x-window-manager &

Any help to fix why my onestep port forwarding through ssh -L 5904:Machine_C:5904 myusername@Machine_B not working? Am I missing something in my .ssh/config?

1 Answer 1


With ssh >= 7.3 (needed only on Machine_A) , those two steps can be done under the hood with the -J/ProxyJump option, simplifying what you have to do (and actually increasing the security of this specific example):

ssh -L 5904:localhost:5904 -J myusername@Machine_B myusername@Machine_C

This way, in addition to simplicity, the VNC access is not also made on Machine_B like you were doing, so other users of Machine_B can't use your VNC.

For the explanation this would be the traditional (secure) way of doing the same:

ssh -L 2222:Machine_C:22 myusername@Machine_B

on an other terminal still on Machine_A:

ssh -L 5904:localhost:5904 myusername@localhost:2222

Note that no tunnel entry point is ever made available on Machine_B. ProxyJump (-J) does about the same under the hood except it uses pipes between the two ssh process instead of port 2222.

Now for being able to not ssh at all to Machine_C, this most likely seem a VNC access/setting problem and not an ssh problem. Are you sure VNC is not restricted there to localhost ? Either by configuration, either by a local firewall?

  • ssh -L 5904:localhost:5904 -J myusername@Machine_B myusername@Machine_C option worked out fine and vnc runs fine with this. Awesome! To answer your question on VNC access/setting, I don't think that was the problem, as it worked fine with my two step process earlier.
    – dr3patel
    Apr 8, 2018 at 10:12
  • Really the fact that the single step got channel 3: open failed: connect failed: Connection refused when accessing 5904 on Machine_C's IP and not localhost makes me believe it is indeed VNC listening only on the lo interface or there is a firewall giving the same effect. Anyway glad you're glad with my answer (which stays secure everywhere)
    – A.B
    Apr 8, 2018 at 10:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .