At the moment, if the server and agents are not co-located, and the agents are behind a firewall, you must set up a firewall rule to forward the port to the agent. It'd be nice if build agents would just dial out and establish the connection to the server and the server would just use this link to communicate back. It would make setting up build agents easier when things are not co-located and if members of an open source project want to host agents.