using stunnel through a proxy

 to protect the vnc port , set up a port to accept connection from wan and forward to local tcp 5900

--- serverside.conf ---
cert = stunnel.pem
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
client = no
[vnc]
accept  = 5899
; suppose port 5899 is a free port(not used by any service), and should be configured to be accessible from wan, forward form firewall(if any)
connect = 5900

--- clientside.conf ---
cert = stunnel.pem
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
client = yes
[vnc]
accept  = 5900
protocol = connect
protocolHost = serverside.ip.here.net:5899
; 5899 here is the accept port in server
protocolUsername = usernamehere
protocolPassword = passwordhere
connect = proxy.ip.com:8080
; assume proxy server can connect to port 5899 , not only common http port 80 , 8000 or 8080

server side, run
start /MIN /B stunnel.exe .\serverside.conf

client side, run
start /MIN /B stunnel.exe .\clientside.conf