2

I need to use a remote desktop connection to my Raspberry Pi 3 from outside the local network. I understand that VNC is not really safe or encrypted so a lot of people a tunneling over SSH.

How do you do that? I suppose I don't forward the VNC port in my router but instead forward the SSH port and then somehow tunnel it through that. Do I need to set up anything on the Pi itself or rather do this on the client (like PuTTY)?

Any help would be appreciated.

On a side note, how secure would that be and what passwords are needed? With SSH having its own password, does it matter how secure the user password is? Is a strong VNC password as important?

Hope someone can point me in the right direction, thanks.

Improve this question
1
  • If it means anything, the default vnc server included in Raspbian pixel is encrypted on pi 3
    – Zackery Painter
    Dec 3, 2016 at 1:25

1 Answer 1

Reset to default
1

From https://www.cl.cam.ac.uk/research/dtg/attarchive/vnc/sshvnc.html

Now, the VNC protocol normally uses port 59xx, where xx is the display number of the server. So a VNC server on a Windows machine, which normally uses display number 0, will listen on port 5900. Most Unix VNC servers will probably use display numbers 1,2, etc and so will be listening on ports 5901, 5902 and so forth. If you forward these ports to a remote machine, you can make the remote VNC server appear to be a server running on your local machine.

So, imagine you had a VNC server running as display :1 on machine snoopy, and you wanted a secure connection to it from your local machine. You could start the ssh session using:

ssh -L 5902:localhost:5901 snoopy

and any references to display :2 on your local machine would actually connect to display :1 on snoopy.

Note that the above SSH command-line is deliberately meant to accept incoming connections only from the local machine. This means that to use the SSH connection that we have just set up, we must connect to it from the same machine, using the special name 'localhost', rather than using the machine's own unique name.

So instead of running a vncviewer:

vncviewer snoopy:1

you could run:

vncviewer localhost:2

and you get the same effect, but with a secure connection.

Its probably a good idea to still use a VNC password unless you are sure no unauthorised people can access the target machine from within its local network.

Improve this answer
4
  • And what about remote connections? I still don't understand how to tunnel VNC through SSH to get a connection from outside my local network, i.e. from the internet.
    – Alexej
    Aug 30, 2016 at 8:37
  • @Alexej The method described above works for any SSH connection (intranet or internet). Your client will grab any traffic sent to the local port being forwarded (5902 per the example) and redirect it to the SSH server. The SSH server will then direct it to the designated machine:port on the remote end (snoopy:5901 per the example).
    – thephez
    Aug 30, 2016 at 13:32
  • I don't see any references to a remote IP in the example. If I am on the internet and want to connect to my RPi at home, I would need to supply that. And I don't need to do anything on the RPi itself to accept SSH to VNC tunnelling?
    – Alexej
    Aug 30, 2016 at 15:35
  • @Alexej snoopy is the "remote" machine in the example - it could just as well be the machine's local IP address (i.e. 192.168.1.100 or 127.0.0.1). Once you've connected with SSH though, the remote network is, in effect, local. Any traffic going through the tunnel appears to originate from the machine you connected to via SSH. You do need to have the AllowTcpForwarding option enabled in the SSH config of the Pi.
    – thephez
    Aug 31, 2016 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.