The JMX connector allows one to configure the port which is used. The RMI port however is chosen at random. This is a problem when connecting through a firewall.
The solution is to allow the configuration of the RMI port. Tomcat for example solves this problem with their JmxRemoteLifecycleListener (https://raw.github.com/apache/tomcat70/trunk/java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java).