using ssh to forward local ports to the outside world

I will split the answer into two parts:

SSH Port Forwarding

Firstly, create an SSH tunnel between Windows client and Linux server. Windows 10 or Windows 11 comes with OpenSSH client pre-installed. Open command prompt or Power-shell and execute the following command:

ssh -fnN -L 5901:127.0.0.1:5901 user@linux_server_public_ip 

-N Do not execute a remote command. This is useful for just forwarding ports (protocol version 2 only)

-n Redirects stdin from /dev/null (actually, prevents reading from stdin). This must be used when ssh is run in the background. A common trick is to use this to run X11 programs (like VNC) on a remote machine. The ssh program will be put in the background. (This does not work if ssh needs to ask for a password or passphrase; see also the -f option.). To overcome password prompt issue, use password-less SSH (aka SSH public key authentication)

-f Requests ssh to go to background just before command execution. This is useful if ssh is going to ask for passwords or passphrases, but the user wants it in the background. This implies -n. The recommended way to start X11 programs at a remote site is with something like ssh -f host xterm.

-L [bind_address:]port:host:hostport - Specifies that the given port on the local (client) host is to be forwarded to the given host and port on the remote side.

Connect to VNC server

From Windows, you can now connect to VNC server through 127.0.0.1 and port 5901

A simple test

To demonstrate that an SSH tunnel is working and possibly identify any firewall issues, you can test using simple web server hosted on your Linux server. I will use python3 simple web server for this demonstration.

# Go to temporary directory or any directory that has no sensitive data $ cd /tmp # Create a test HTML file $ echo "test web site" > index.html # Start the web server $ python3 -m http.server # By default server will listen on port 8000 and all interfaces. 

From your windows laptop, open a web browser and go to Linux server's public IP on port 8000, http://linux_server_public_ip:8000. If you get a test page on your browser, then proceed to next step.

# On Linux server, stop the python simple web server # Then start the python web server but this time bind to loopback address `127.0.0.1` $ python3 -m http.server -b 127.0.0.1 

Since the web server is now bound to loopback address, it is no longer directly reachable from outside (meaning that web server is no longer directly exposed). This is where SSH tunneling comes in.

On Windows laptop, start an SSH tunnel (keep port 8000 in mind)

ssh -fnN -L 8000:127.0.0.1:8000 user@linux_server_public_ip 

Once the SSH tunnel is up, you can open a web browser once again, but this time visit http://127.0.0.1:8000

References:

• Configure password-less SSH - https://www.redhat.com/en/blog/key-based-authentication-ssh
• SSH Tunneling / Port forwarding - https://www.cbtnuggets.com/blog/technology/networking/what-is-ssh-port-forwarding

Side Note: I suggest that you continue using 127.0.0.1 and shy away from using localhost. By default, when you ping localhost on a Windows a machine, the response comes back with an IP address of ::1 instead of 127.0.0.1. By default, IPv6 takes preference over IPv4, and this might break your SSH tunnel.

I am using windows 11 with putty as my VNC Client.

I assume you meant "with putty as my SSH client"? PuTTY has no VNC functionality whatsoever.

In the Connection -> SSH -> Tunnels page of PuTTY configuration, type in 5901 to the Source port field, then type localhost:5901 to the Destination field. Leave the radio buttons to their default values: Local and Auto respectively. Then click on Add.

This should add a line to the Forwarded ports text box with the following text:

L5901 localhost:5901 

The forwarding is fully configured only after this line appears. A common mistake is to just fill in the Source port and Destination boxes and leave the Tunnels configuration page: if you don't click Add, this does nothing at all.

Then return to the Session settings page, fill in the hostname/IP of the server, save your settings for later use if you want, then click Open.

Once the SSH connection is established and authenticated, the PuTTY client will start listening on port 5901 of your local Windows system, and passing any traffic to the sshd at the remote end, instructing sshd to establish connection to localhost:5901 (= the server's localhost) and pass the forwarded traffic to it. Any responses will be passed back the same way.

So, after establishing the SSH connection and logging in, if the remote sshd allows port forwarding, you should now be able to start up a VNC client, tell it to connect to localhost:5901 and be able to see the VNC server of the remote system over the SSH-forwarded connection.