mjhjmtu

Here's the scenario: I have 4 hosts.

• Client/localhost


• AWS bastion host (port 22 only)


• EC2 Instance with graphical desktop (private subnet)


• EC2 Instance (no graphical) with Docker running a WebLogic Server container

Problem: I need to be able to access that WebLogic server via internet browser through the bastion host. Now I can only use port 22 to the bastion host but all outgoing connections are enabled.

My idea was to use TightVNC viewer and SSH tunnel through the bastion host to the GUI instance.

Now my issues is I don't know how to get my bastion host to forward incoming port 22 for my user to the destination port 5905, in my case. I do not have root access on the bastion host.

All of the solutions I've found so far involve SSHing via command line, not using VNC. I need the bastion to automatically forward port 22 traffic to the VNC port, for my user only if possible but not 100% required.

public public private private
[user/client] --22-->[bastion]--VNC:5905-->[VNC Server]--80/443-->[Docker/WLS]
GUI CLI GUI CLI 

This should be a pretty normal ssh -L 5905:vnchost:5905 user@bastionhost, followed by vncviewer localhost:5905 on the public client system, unless the bastion server is explicitly disabling SSH tunneling or there is firewalling between it and the VNC server host.

The -L 5905:vnchost:5905 (alternately written -L localhost:5905:vnchost:5905) parameter means that the ssh client node will open a port on localhost:5905 and the SSH server daemon on the bastion host should try to send the tunnel to vnchost:5905 when the VNC viewer on the client side tries to initiate a connection.

If the connection can't be made, an error message should appear in the SSH session (and the VNC client will probably throw an error too).