Open an RDP or VNC remote desktop through SSH

Create a dedicated remote-desktop local forward from a saved connection or SSH host, then open your chosen desktop client.

Open the full-size diagram

Create the connection

From a supported connection or preset host’s menu, choose New Remote Desktop… when an appropriate client is available. You do not need an existing 3389 mapping. Set a display name, SSH host and remote target, then select RDP or VNC. The app saves a dedicated local-forward profile marked RD (Remote Desktop). Keep the local listener on 127.0.0.1; RDP usually targets 3389 and VNC 5900. An ordinary mapping targeting 3389 does not by itself enable automatic desktop launch.

RDP settings

Install Microsoft Windows App (formerly Microsoft Remote Desktop) from the Mac App Store. The Windows username initially inherits the SSH username and remains editable; a domain is optional. Configure window/full-screen mode, resolution, monitors, audio and supported redirection/display options as needed. Advanced options cover supported gateway, RemoteApp or alternate-shell settings; mutually exclusive controls are hidden. An alternate shell starts a specified remote program instead of the normal desktop, if the server permits it. Enter the Windows password in the desktop client.

VNC settings

Choose the system default, Apple Screen Sharing or a specified VNC application. The VNC username also initially inherits the SSH username and can be changed. The generated vnc:// address follows username changes until you customize the address yourself. Select the actual application path for a custom client. RealVNC, TigerVNC and TurboVNC have dedicated launch handling; other clients must support VNC URLs. Passwords belong in the selected client, never in the URI. Local shared folders and device redirection remain subject to that client’s support and permissions.

Connect and diagnose

Choose Save or Save & Connect as available; use Open Remote Desktop on the saved RD profile to open it later. Secure Pipes establishes SSH and checks the forwarded target before launching the client. It does not detect or install a remote desktop server, bypass its permissions or prove a successful desktop login. The destination must run RDP/VNC and be reachable from the SSH server. If opening fails, inspect the SSH state, target port, installed client and Logs. SSH trust/credential prompts and the desktop client’s own authentication still apply. Disconnecting the tunnel ends its transport.