From time to time I have a need to connect to a system inside another remote network (usually my work). Normally I just ssh in and then jump to the machine I need to be on. That’s all fine and dandy if you don’t need a GUI. What if you need to be on the GUI console of the target machine inside the firewall and the firewall doesn’t allow the port you need to use?
Enter VNC and PuTTY. You aren’t limited to doing this with PuTTY or VNC. It’s just that a majority of my work is done from a windows machine and I refuse to install the bloated CYGWIN app on my machine just to get an ssh command line session. Bah.. that’s a story for another day. Anyway- SSH tunnels can be a bit confusing to the lay person so I thought I’d do a graphical illustration to help that out.
In this scenario, I will be using my laptop at home to connect into a landing pad UNIX machine at work. I will then open a tunnel to another machine inside the remote network that will establish a connection to the VNC server running on that machine. I won’t go into how to set up a VNC Server on linux as there are plenty of tutorials out there that will cover it. The one thing I will say is make sure you use a password when you start it up. This is a visual example of what the connection looks like:
Here are some enlarged views so you can see what’s going on. First we start PuTTY on the laptop. I’ll show an example of what options you need to select inside the Putty connection later. Once the tunnel is in place, fire up your favorite VNC client and point it to 127.0.0.1 or localhost on port 59001:
We pointed our VNC client to the address and port of the tunnel we just created, so the traffic is sent through the tunnel into the external Landing Pad and being forwarded on into the remote network:
Finally, the tunnel terminates on the server inside the remote network and connects the tunnel to port 5901 on that machine:
It may seem odd to connect your VNC client to the laptop’s localhost address in order to reach the target machine. This is because you’re sending that traffic through the SSH tunnel that we set up rather than pointing it directly to the server you want to reach.
Now I’ll show you how to configure PuTTY to create the tunnel. First, fire up Putty and populate the username and IP address of the landing pad server in our example (substitute yours of course). Leave the port at 22:
Next, scroll down on the left hand side in the Category window and select Tunnels. Here, populate the source port (59001 in my example), the IP address of the final destination server along with the port you want to connect to on that machine (5901 in my example). Remember, you aren’t putting the IP address of the landing pad here- we want the target server in the Destination field. Once you have the Source port and Destination fields filled in, click Add and it will pop into the window as seen below:
To establish the tunnel, click Open. This will launch the PuTTY terminal and prompt you for your password. In this screenshot, I’m using root to log in however generally it’s a good idea to use a non-privileged user to log into any machine:
Once you see the user prompt and you’re logged in, the tunnel is now in place. Keep in mind that this SSH session you have open is the only thing keeping that tunnel open. If you log out of the shell, it also tears down the tunnel so keep this window open while you’re using the tunnel.
The next step is to launch a VNC Viewer on your laptop and point it to your local machine on port 59001:
Click the connect button and you should see the next window prompting you for the password you set up earlier:
Finally, once you click OK you will be brought to your VNC Desktop on the machine inside the remote network!
So let’s take a step back and review what we’ve effectively done here:
Start VNC server:
We have to start a VNC server on the target computer, along with configuring a password to keep everyone else out. This would have to be done separately.
We first establish the tunnel from the laptop, through the landing pad and finally to the remote server. I’m making the obvious assumption here that you have the landing pad accessible to the internet on port 22 and that you have an SSH server running that will accept such connections. You’re effectively logging into the landing pad just like you would on any other day. The difference here is that we’re also telling PuTTY to set up a tunnel for us pointing to the remote server as well. Aside from that- your login session will look and feel just the same.
Launch VNC Client:
We then start the VNC client on our laptop. Normally, we would point it directly to the server we want to VNC into. In our case, we created a tunnel that terminates on your laptop at port 59001. So we connect our VNC client to the laptop (localhost or 127.0.0.1 should work) and point it to port 59001 instead of the standard port 5901. The VNC client doesn’t care how the traffic is getting to the VNC server, it just does its job.
Think of this SSH tunnel as kind of a wormhole if that type of thing were to actually exist. The traditional method of connecting to your remote endpoint would be similar to pointing our space shuttle towards the Andromeda galaxy which is about 2.5 million light years away. It’s essentially not possible to get there- similar to a firewall that is blocking us. But what if there were a wormhole that terminated near Earth that ended in the Andromeda galaxy? If we were to point our space shuttle into the wormhole, theoretically we would pop out the other side at our target.
If you do plan on doing something like this, make sure you network administrator is ok with it. They may detect the traffic as malicious if they’re not sure where it’s coming from and you may wind up in trouble. I hope this helps give a basic understanding of how SSH Tunnels work.