VNC over SSH via bastion

vnc-over-ssh.sh

# You want to VNC to Box A but you don't have access to it
# over public Internet. You do have SSH access to Box B in 
# the same private network.

#            firewall
# ┌─────┐       ╏╏    ┌─────┐
# │ You │──SSH──╏╏────│  B  │ bastion
# └─────┘       ╏╏    └──┬──┘
#               ╏╏      SSH
#               ╏╏    ┌──┴──┐
#               ╏╏    │  A  │ VNC target
#               ╏╏    └─────┘


# On Box B (via ssh)
ssh -N -L 5001:localhost:5900 user@boxA

# On your local machine
ssh -N -L 5900:localhost:5001 boxB

# On your local machine, you can now VNC to Box A with
# vnc://localhost (using Safari/Finder/VNC app)