JConsole over ssh local port forwarding

There’s an even nicer way to do this using an SSH socks tunnel, since JConsole supports SOCKS:

1. Create the SSH socks proxy locally on some free port (e.g. 7777):

   ssh -fN -D 7777 user@firewalled-host

2. Run JConsole by specifying the SOCKS proxy (e.g. localhost:7777) and the address for the JMX server (e.g. localhost:2147)

   jconsole -J-DsocksProxyHost=localhost -J-DsocksProxyPort=7777 service:jmx:rmi:///jndi/rmi://localhost:2147/jmxrmi -J-DsocksNonProxyHosts=

As mentioned in one of the answers below, from JDK 8u60+ you also need to have the -J-DsocksNonProxyHosts= option in order to get it working.