client —> firewall -> (public sshd box–> private vnc box)
1)Open Connection->SSH->Tunnels and fill in values for the Source port (your client machine's port that do local proxy) and the Destination machine and port. Remember that the ip is relative to the tunnel's end point, not your machine. Be sure to leave the 'Local' option box checked.
in the above case, Source port can be any value you like in the client side.
the destination machine is a local IP of private vnc box in the LAN relative to sshd box;
port is the VNC service port 5900.
2) Chick 'Add' to save the tunnel.
3)Return to the 'Session' tree node (which is the opening screen), fill in the sshd box's ip address and port 22,
deine a session name and click 'Save'.
4)Then click 'Open' to launch the connection to your remote SSH service, answer user name and password , you now
set up the tunner.
5) in the client , launch VNC viewer, fill 127.0.0.1:port the port is the source port defined in step 1.