Multi-hop VNC tunnel over SSH
 

Is it possible to chain together multiple SSH tunnel hops in a single `ssh -L` command on the client side? I have two gateways I need to get through in order to access a remote host. For a normal SSH client connection, it's simple enough chain this all together by simply appending the additional SSH connection commands to the first one:
And for a normal (non-hopping) VNC session to a non-gateway host, create a tunnel:
But is it possible to chain together multiple gateway hops in order to reach the remote host, given SSH authentication is done via key on each host, and privileged ports are not accessible on the gateway machines? I've gotten close with the following, but tripped up by man-in-the-middle attack warnings:

Hi
how about this:
and then on remote.host you simply do a "vncviewer"?

Hi sys64738,

Yes: of course that works. But my question is whether it's possible to tunnel multiple hops and script everything entirely on the client side.

How about that:

If you have public key authentication it will work in a script without passwords and there is no hassle with tcp ports (only 22 needed).

I hope that is OK?

Hi sys64738,
Yes, thanks, but ... really my question was more toward _understanding_ the "hassle" of using ports properly with a multi-hop tunnel, rather than working around them.

OK back to your ssh statement. If I got it right you said you got warnings about man in the middle attacks.
If you want to ignore those warnings add:
which would lead to:
But you must be sure that you address the right hosts along your tunnel.
BTW I think you have to tell the 'some.vnc.viewer' on remote.host to use port 50022.

Thanks sys64738. `StrictHostKeyChecking` was the key, though it should not be used on untrusted systems. Note that you don't need to specify the vnc port on the remote host, but you do need to specify a display port: