Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Note: This is not, repeat not a question about tunneling VNC over something else, e.g. SSH. That's an entirely different thing.


I have a machine M1 on some network segment which is accessible from machine M2 outside the segment via VNC , but (for the sake of discussion) no other protocol whatsoever. No other machines on that segment are accessible from outside the segment. Also, M1 and other machines on its local segment have limited outgoing connectivity; specifically, M1 cannot connect by SSH to any nachine outside of its own local segment (and maybe not even there).

Now, if I run a VNC client on M2, direct it at M2, login and start a shell, I can basically run whatever I want and access machines on M1's local segment. However, I'm limited by the graphical interaction of the VNC client.


I would like to be able to tunnel connections somehow from my machine M2 to any machine on M1's local segment, to anywhere I would be able to connect from M1.


How can I do this? Or rather, have the tools necessary for this been developed yet, and are freely available?


VNC is pixel-based. I'm not familiar with the protocol, but supposing there is no interesting "side-channel" data, it seems like what we would need is a binary or script on M which would open up a window, or just any rectangle, on the VNC 'display', using the rectangle for output and the keyboard/mouse movement that this window gets as input. These two pipes can be used to communicate, say, with a shell session (or an nc session if you like). The keypresses become the input stream (perhaps limiting ourselves to base64), and the pixels correspond to the output stream (and we'll have either a really small window which changes very rapidly or, well, a larger windows which must also change pretty rapidly.

On the other side, the VNC 'client' must not display any of this junk on screen, nor take keyboard or mouse input, but rather just use ports to feed this data in and out.

What do you think?

[ The machine has an SSH server, but it only supports localhost connections

share|improve this question
I really don't see the point in doing that. You could certainly play with the protocol and develop some kind of extension to turn pixels into data representation for file transfers. VNC is not secure by default, so why bother doing that. There is a whole bunch of other solutions to transfer data. If you can't get access to the SSH server, maybe can you start an SSH session from this machine to you? – Gregory A. Lussier Aug 3 '13 at 18:42
The word "maybe" was there to inform you I did not know whether it was possible or not. – Gregory A. Lussier Aug 4 '13 at 1:02
Sorry about my earlier comment. See Edit. – einpoklum Dec 24 '13 at 12:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.