MacOS – How to use OSX built in VNC client to connect to localhost with port forwarding

It looks to me like you're using the wrong remote IP address in your tunnel. You should be using -L 5901:127.0.0.1:5900 ....

It's important to realize that the destination IP for the tunnel is where the remote (server) computer forwards the connection to, so 127.0.0.1:5900 means it connects to port 5900 on the server itself.

It looks like you're using ssh -L 5901:PublicIPofServer:5900 ..., which makes the server try to connect to port 5900 on its own public IP. But that's actually the WAN IP of the router the server's behind, so unless that router forwards port 5900 to the private IP of the server (in which case you wouldn't need the SSH tunnel) AND the router supports NAT loopback (aka hairpin NAT), this won't work.

The answer to that question is correct, but there are some nuances.

Screen Sharing server supports 4 authentication types:

1. Mac OS X user login / password
2. Apple ID
3. Request for observe / control ("Anyone may request permission to control screen")
4. VNC password ("VNC viewers may control screen with password")

Whenever the built-in Screen Sharing client (Cmd+K in Finder) connects to a Screen Sharing server, it uses only types 1, 2 and 3. Then server enables traffic encryption that may work in one of two modes: full encryption or keystroke/mouse move encryption. You could select encryption mode in earlier versions of Mac OS X, but in 10.8 (AFAIR) they removed this option, so Screen Sharing connection is always fully encrypted.

AFAIK there are only two third-party iOS clients that support Screen Sharing authentication types: Screens and Remotix. Both can use authentication types 1 and 3 with keystroke/mouse move encryption, but it seems that full encryption is provided only by Remotix.

Note that if a client uses VNC password (type 4) to connect to Screen Sharing server, then encryption is disabled at all.