You can forward a port (using the LMCE firefall config) to your desktop IP, which I wouldn't do.
Or, you could change your ssh tunnel to use the IP of the desktop machine, instead of the core loopback address
ssh -p 22 -L 5900:<internalIPofDesktop>:5900 <coreUser>@<externalIP>
This won't ssh straight to your desktop. It will still ssh to the core. But, the port forward will be to your desktop. If you really needed to ssh to the desktop to run some commands, you could just ssh from the core to the desktop (no port forwarding req'd).