When an agent is launched through JNLP, the agent attempts to connect to a specific TCP port of Jenkins to establish a communication channel. But some security sensitive network can prevent you from making this connection. This can also happen when Jenkins runs behind a load balancer, apache reverse proxy into DMZ, and so on.

This tunneling option allows you to route this connection to another host/port, and useful for those situations. The field can either take "`HOST:PORT`", "`:PORT`", or "`HOST:`". In the first format, JNLP agent will connect to the given TCP port on the given host, and assume that you've configured your network so that this port forwards the connection to Jenkins' JNLP agent TCP port.

In the latter two formats, the default host name and port number (that is, the host name that Jenkins runs, and the TCP port that Jenkins opened) are used to augment the missing values. In particular the `HOST:` format is useful if the HTTP reverse proxy is used and Jenkins actually runs on another system.