SSH Socks Proxy
Monitoring of any JMX enabled application that is behind firewall is almost impossible cause standard JMX implementation uses random port for server-port. Easy way how to connect without any changes of application is to use SSH Socks Proxy:
ssh <hostname> -D9999
jconsole -J-DsocksProxyHost=localhost -J-DsocksProxyPort=9999
For final connection you can use standard host and port definition:
<hostname>:<registry-port>
Tomcat JmxRemoteLifecycleListener
Tomcat has its own workaround for this situation and implements JmxRemoteLifecycleListener that can be used to setup fixed port numbers both for registry-port and server-port.
For configuration details see Tomcat documentation.
