I assume from your description that the login node can directly access
VNC servers running on the HPC nodes, so SSH is only required between
your client machine and the bastion machine and between the bastion
machine and the login node. I also assume that neither the login node
nor the bastion node has any services that listen on the TCP ports
normally reserved for VNC (5900-5999.) In that case, you can set up the
multi-level SSH tunnel manually. If you know that the VNC server is
running on host "hpc1" and listening on Display :1, for instance, then
you can do something like:
client$ ssh -L5901:localhost:5901 bastion
bastion$ ssh -L5901:hpc1:5901 login_node
The first command sets up an SSH connection between the client and the
bastion node and forwards traffic meant for Port 5901 on the client to
Port 5901 on the bastion node. The second command sets up another SSH
connection between the bastion node and the login node and forwards
traffic meant for Port 5901 on the bastion node to Port 5901 on hpc1.
Then, in another window on the client, you can do:
/opt/TurboVNC/bin/vncviewer localhost:1
The multi-level SSH tunnel has to be set up in this way because you
can't re-use the server end of an SSH tunnel outside of the SSH session.