You can use SSH tunnels to securely connect to kernels on remote machines or across networks that do not permit open ports.
Pattern 1: Kernel on a local LAN machine
If the kernel is running on a machine (worker) listening on loopback, use the --ssh argument with the hostname of that machine and the --existing flag pointing to the connection file.
user@client $> jupyter qtconsole --ssh=worker --existing /path/to/kernel-12345.json
Pattern 2: Kernel behind a firewall (via a login node)
If the kernel is on a worker machine that is only visible to a login node, the kernel must be started listening on an external interface (e.g., 0.0.0.0). Then, connect from your client via the login node:
user@client $> jupyter qtconsole --ssh=login --ip=192.168.1.123 --existing /path/to/kernel-12345.json
Note: The --ip should be the address of the worker as seen from the login node.
# Example for Pattern 1
user@client $> jupyter qtconsole --ssh=worker --existing /path/to/kernel-12345.json