Yes, tunnels are secure.

Use the VNC viewer (GUI) to connect to your (mobile client) end of the tunnel. if you have the VNC server listening at the other end, it will seem to that machine that the client is connecting locally.

The x11vnc app is not required.

Note that since the VNC server is a Windows machine - and Windows can only host one session (zero) - the real port at the server end is probably on port 5900 (ie server:0) That would be"-L5901:localhost:5900"

Be sure your Windows machine knows what 'localhost' is... if not, you could use: "-L5901:127.0.0.1:5900"