What I'm doing is using a vncviewer to connect to a vncserver, via an intermediary host (such as a firewall), using a SSH Tunnel between HostA and HostC, to encrypt communications.
I have the same unprivileged userid on all three hosts. Also, I used ssh keys for authentication, just to speed things up. Otherwise, you can specify username@host and enter the password when asked.
$ ssh -N -T -X -f HostB.example.com -L 5905:HostC.example.com:5905 --sleep +30m
$ vncviewer localhost:5905 &
$ vncviewer localhost:5905 &
Change the “+30m” to however long you want the ssh tunnel to stay open. You can also use “+8h” or “+1d”.
+----------+ +----------------+ +-------------+
| Host A | | | | Host C |
| |------->| Host B |------->| destination |
| vncviewer| | "intermediary" | | vncserver |
+----------+ +----------------+ +-------------+
