I'm not sure I understand tunnelling very well but do I NEED to forward port 5900? The reason I ask is that I want to VNC to a machine where I'm not the admin of the firewall it's behind.

This firewall only lets me connect to the machine through one port, say port 1234, I can ssh to this machine through this port but how can I also use VNC? Is it possible?