Network structure

I want to setup a simple method acessing a machine A from a machine B with VNC. Both machines are behind a NAT. I have a raspberry with ddns setup.

A -> NAT1 -> rasp <- NAT2 <- B

Usual solution is the following:

  • side B connects to the rasp via ssh with local port forwarding and start the vncviewer listening on a local port
  • side A connects via ssh to the rasp with remote port forwarding and start x11vnc on a local port

One could also invert the forwarding by using vnc in reverse mode.

The problem

In this case, side A has no credentials for the server.

The solution to which I'm thinking is to create the same port forwarding as with ssh but without credentials (and encryption) and leaving vnc making the encryption with SSL.

For such a solution, when side B connects to the rasp and creates the ssh tunneling, it could also start a server that waits for the next connection and setup the forwarding for client A, who instead can simply use socat.

Is my idea feasible? Are there any other software for creating prot forwarding without authentication?

No one can change how the NAT are configured

  • Do you control NAT1 so you can set up port forwarding on it? Does NAT1 expose a public IP address that rasp can contact? (Some ISPs use carrier grade NAT, and in this case you can't do port forwarding).
    – dirkt
    Dec 23, 2020 at 4:19
  • The solution I'm searching should work for any NAT/router
    – fortea
    Dec 23, 2020 at 8:41

1 Answer 1


So assuming that NAT1 does have a public IP, start x11vnc on a local port on A, configure NAT1 to port forward this (possibly to some other port) on whatever public IP NAT1 ends in, have B do a jump-host style forwarding with ssh from A to the NAT1 port via raspi.

The disadvantage of this is that everyone else will also be able to connect to that port on NAT1, so basically everyone can control A via x11vnc, unless you start it with the login screen from the display manager.

So it's a very unsafe setup. This does not apply if your whole setup is in an internal network (but then, there's no real reason to use NAT).

Alternatively, if either B or rasppi can store credentials, you could port forward the ssh port from A via NAT1. Then you could use ssh forwarding from B via rasppi to A (or maybe even directly from B to A).

Again, everyone else can now access the forwarded ssh port, but at least this works with credentials, and you can secure it (for example, use a certificate, and turn of password login).

  • No one can change the NAT configuration in my case
    – fortea
    Dec 23, 2020 at 14:58
  • That's why I asked "do you control NAT1 so you can set up port forwarding on it?" ... with missing information it's difficult to answer your question.
    – dirkt
    Dec 23, 2020 at 15:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .