Communication between java proxy and monitored JMX application should not be firewalled, proofs:

https://github.com/gehel/jmx-rmi-agent <- just read description
http://serverfault.com/questions/308662/how-do-i-fix-a-failed-to-retrieve-rmiserver-stub-jmx-error
http://stackoverflow.com/questions/8734981/java-jconsole-jmx-connection-failure
http://olegz.wordpress.com/2009/03/23/jmx-connectivity-through-the-firewall/ <- wery nice one
https://blogs.oracle.com/jmxetc/entry/connecting_through_firewall_using_jmx

Also, if on a server hosted a java app are several network interfaces, there is some requirement to specify "java.rmi.server.hostname" (see olegz.wordpress.com article)
I think we could use Oracle's blog article hyperlink in our doc.

Our doc should be improved (by adding one note) because users have troubles with this.