VisualVM over ssh

You either need to run jstatd on the remote side, or specify a JMX connection using host:port.

Jstatd:

jstatd -J-Djava.security.policy=permissions.txt [-p port]

After that: add a remote connection to the target machine, and on the properties of that remote connection configure the jstatd connection.

(permissions.txt contains for example this:

grant {
  permission java.security.AllPermission;
};

Edit: (Answer to comment)

1. ssh -D 9696 me@remote, and run jstatd as above on the remote command line. If you want jstatd to be on a different port than the default 1099, use the -p argument to jstatd.

2. run visualvm.exe -J-Dnetbeans.system_socks_proxy=localhost:9696 -J-Djava.net.useSystemProxies=true on the local machine

3. in visual vm: add new remote connection, and specify remote as host and the port for jstatd (1099 for default, or what you specified with -p when running jstatd)

   You should now see the processes on the remote side in visualvm

I have another solution using standard SSH tunneling and no firewall ports to open. For me, SOCKS proxy does not work.

Start your JVM with options:
-Dcom.sun.management.jmxremote=true
-Dcom.sun.management.jmxremote.ssl=false
-Dcom.sun.management.jmxremote.authenticate=false
-Dcom.sun.management.jmxremote.port=[port1]
-Djava.rmi.server.hostname=localhost
-Dcom.sun.management.jmxremote.rmi.port=[port2]

The important part is "server.hostname=localhost". Additionally, you explicitly define both ports (connect + "random" RMI port), "jmxremote.rmi.port" needs at least Java 7 update 4 (I read somewhere, did not check this info - use "lsof -i" on your server machine to check the really used ports).

(Of course, you may use authentication or SSL.)

Connect via ssh to the server and forward your local port1 and port2 to localhost:port1|2 an the server.

In VisualVM open a JMX connection to localhost:port1 (without any proxy setting).