Cannot connect to VM screen via VNC

I have set up an ubuntu VM on my NAS running ElectricEel-24.10.1 on the UGREEN DXP 6800 Pro. Since SPICE is quite bad honestly, I wanted to access the VM screen via VNC. To me, it seems like this works as follows: Connect a VNC viewer to the NAS’s IP with the port number shown for each VM on the “Virtual Machines” dashboard. I tried a few things and they did not work:

I started with the simplest approach. The VM was running and I used Apple screen sharing (which should be VNC compatible, at least that worked in other scenarios in the past). The “display port” shown for me is 5901. Let’s assume the IP of my NAS is 1.2.3.4. Immeadiately when trying to connect, the connection is interrupted and screen sharing reports it could not connect.
That in itself is not surprising. There could be some network device between me and the NAS filtering the connection, acting as a firewall.
To make sure it was not an Apple issue, I repeated the attempt with Remote Ripple (“Connection Refused”) and RealVNC Viewer (“The connection was refused by the computer”).

The solution to this: Using an SSH Tunnel. So I ssh 1.2.3.4 -vvv -L5901:127.0.0.1:5901’d into the NAS. Connecting Apple screen sharing to 127.0.0.1:5901 hangs for around a minute and then tells me that the connection did not work. The verbose output from ssh on the NAS reads

debug1: Connection to port 5901 forwarding to 127.0.0.1 port 5901 requested.
debug2: fd 10 setting TCP_NODELAY
debug3: fd 10 is O_NONBLOCK
debug3: fd 10 is O_NONBLOCK
debug1: channel 3: new direct-tcpip [direct-tcpip] (inactive timeout: 0)
debug3: send packet: type 90
debug3: receive packet: type 91
debug2: channel 3: open confirm rwindow 2097152 rmax 32768
<delay>
debug3: send packet: type 100
<delay>
debug3: receive packet: type 98
debug1: client_input_channel_req: channel 2 rtype keepalive@openssh.com reply 1
debug3: send packet: type 100
<connection dropped>

For the SSH tunnel, I reconfigured the SSH connection from the UI: I set “Allow TCP Forwarding” and added

GatewayPorts no
PermitTunnel yes

to the Auxiliary parameters.

Similarly, on the NAS telnet 127.0.0.1 5901 hangs and then breaks the connection after some time. When I instead Ctrl-C, I get “Connection closed by foreign host”.
It seems that whatever happens at that port is not working correctly.
Is this even intended to be used like this?

The VM is clearly running, I can see the screen in SPICE. There are three devices attached to the VM: The Disk, the Display and the NIC. For the display, the UI config is:

Port: 5901
Resolution: 1280 x 720
Bind: 127.0.0.1
Password: *********
Web Interface: On (or Off, does not matter)
Device Order: 1002