Communication between java proxy and monitored JMX application should not be firewalled, proofs:
https://github.com/gehel/jmx-rmi-agent <- just read description
http://olegz.wordpress.com/2009/03/23/jmx-connectivity-through-the-firewall/ <- wery nice one
Also, if on a server hosted a java app are several network interfaces, there is some requirement to specify "java.rmi.server.hostname" (see olegz.wordpress.com article)
I think we could use Oracle's blog article hyperlink in our doc.
Our doc should be improved (by adding one note) because users have troubles with this.