Tunelling VNC through two ssh hops

Question

I've long seeked a solution to tunnel to a machine behind a firewall, passing VNC (or other ports) through. Like explained in this old usenet post, which I'll recap here:

I have to log through an intermediate machine, something like:

local $ ssh interim
interim $ ssh remote
remote $ ...any commands...

This works fine. But now I am trying to tunnel a vnc session from remote to local and I can't find the magic incantation, using either one or two steps.

Answer 1

I recently found a wonderfully simple and adaptable solution: simply tunnel the ssh to the target system through the connection to the firewall. Like such:

local $ ssh -L 2222:remote:22 interim
interim $ ...no need to do anything here...

In another local console you connect to localhost on port 2222, which is actually your remote destination:

local $ ssh -C -p 2222 -L 5900:localhost:5900 localhost
remote $ ...possibly start you VNC server here...

In yet another local console:

local $ xtightvncviewer :0

It's that simple. You can add any port forwarding you want to the 2nd command (-L localport:localhost:remoteport) just like if there wasn't any intermediate firewall. For instance for RDP: -L 3389:localhost:3389