Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a friend who lives far away and needs technical support. So far I've been unable to diagnose the problem over the phone, so I was looking to use a VNC connection to remotely troubleshoot his computer. We both have Macs.

The issue is that he is behind a firewall, and all the ports are filtered (checked using nmap). Since I'm behind a firewall too, I was wondering if it would be possible to set up some sort of forwarding connection to my Linode VPS. i.e., We would both connect to my VPS, and all my VNC traffic would be forwarded through the VPS to my friend's computer (and since we both initiated connections to the VPS, there wouldn't be any issues with firewalls).

share|improve this question
up vote 1 down vote accepted

You need a reverse SSH tunnel, and a regular SSH tunnel, and you join them together in the middle.

We have 3 machines. Friend, Server, Mac.

From Friend, you connect to Server using SSH, setting up a tunnel in the reverse direction.

ssh -R 9999:localhost:5900 user@Server

This creates an ssh session from Friend, to Server. On Server it listens on port 9999 (on the localhost address), and forwards anything on that port, back to Friend on port 5900 (through the ssh tunnel, so the firewall doesn't block it).

On Friend, you now need to ensure there's a VNC server listening on port 5900 (this is the default port for VNC servers).

Then, from Mac, you do this,

ssh -L 9999:localhost:9999 user@Server

That tunnels everything on port 9999 at your end, to port 9999 on the localhost on Server. Since 9999 on Server is then forwarded to Friend, you've joined the tunnels together.

Now, you can open a VNC Client on Mac, and connect it to port 9999 (i.e. when it asks what to connect to, you connect to

The ssh daemon on Server needs to support port forwarding for this to work.

You can do this with only one tunnel (the reverse tunnel from Friend using a slightly different format), but that leaves the Friend computer at risk because it would allow anyone to VNC to Friend by connecting to the port on Server's public IP address. This way, only you can connect.

share|improve this answer
This answer was perfect. Thank you! – user1419674 Jun 23 '13 at 1:47
It's good. I would also want to note that with single tunnel option you would need to specify bind_address (possibly enable GatewayPorts) as forwarding is by default limited to loopback interface. – doc May 9 '15 at 15:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .