i have one slave on one data center can connect to master(using swarm client) using public conncetion,
here is log:
INFO: Attempting to connect to https://xxxxxx/ 371e2634-ff28-4e97-a20d-e91910259504 with ID
Feb 02, 2017 6:16:19 PM hudson.plugins.swarm.SwarmClient getCsrfCrumb
SEVERE: Could not obtain CSRF crumb. Response code: 404
Feb 02, 2017 6:16:20 PM hudson.remoting.jnlp.Main createEngine
INFO: Setting up slave: SLAVE-JAVA-AWS-STAGING-TUNN
Feb 02, 2017 6:16:20 PM hudson.remoting.jnlp.Main$CuiListener <init>
INFO: Jenkins agent is running in headless mode.
Feb 02, 2017 6:16:20 PM hudson.remoting.jnlp.Main$CuiListener status
INFO: Locating server among https://xxxxxx/
Feb 02, 2017 6:16:20 PM hudson.remoting.jnlp.Main$CuiListener status
INFO: Handshaking
Feb 02, 2017 6:16:20 PM hudson.remoting.jnlp.Main$CuiListener status
INFO: Connecting to xxxxxx:50000
Feb 02, 2017 6:16:20 PM hudson.remoting.jnlp.Main$CuiListener status
INFO: Trying protocol: JNLP3-connect
Feb 02, 2017 6:16:20 PM hudson.remoting.jnlp.Main$CuiListener status
INFO: Server didn't accept the handshake: Disabled protocol:Protocol:JNLP3-connect
Feb 02, 2017 6:16:20 PM hudson.remoting.jnlp.Main$CuiListener status
INFO: Connecting to xxxxx:50000
Feb 02, 2017 6:16:20 PM hudson.remoting.jnlp.Main$CuiListener status
INFO: Trying protocol: JNLP2-connect
Feb 02, 2017 6:16:20 PM hudson.remoting.jnlp.Main$CuiListener status
INFO: Connected
Feb 02, 2017 6:16:21 PM com.youdevise.hudson.slavestatus.SlaveListener call
INFO: Slave-status listener starting
Feb 02, 2017 6:16:21 PM com.youdevise.hudson.slavestatus.SocketHTTPListener waitForConnection
INFO: Slave-status listener ready on port 3141

but when i have other slave on other data center can't connect to master(using swarm client) using tunnel conncetion,
here is log
INFO: Attempting to connect to https://xxxxx/371e2634-ff28-4e97-a20d-e91910259504 with ID
Feb 02, 2017 6:09:35 PM hudson.plugins.swarm.SwarmClient getCsrfCrumb
SEVERE: Could not obtain CSRF crumb. Response code: 404
Feb 02, 2017 6:09:36 PM hudson.remoting.jnlp.Main createEngine
INFO: Setting up slave: SLAVE-JAVA-AWS-STAGING-TUNN
Feb 02, 2017 6:09:36 PM hudson.remoting.jnlp.Main$CuiListener <init>
INFO: Jenkins agent is running in headless mode.
Feb 02, 2017 6:09:36 PM hudson.remoting.jnlp.Main$CuiListener status
INFO: Locating server among https://xxxxxx/
Feb 02, 2017 6:09:36 PM hudson.remoting.jnlp.Main$CuiListener status
INFO: Handshaking
Feb 02, 2017 6:09:36 PM hudson.remoting.jnlp.Main$CuiListener status
INFO: Connecting to xxxxxx:50000
Feb 02, 2017 6:09:36 PM hudson.remoting.jnlp.Main$CuiListener status
INFO: Trying protocol: JNLP3-connect
Feb 02, 2017 6:09:36 PM hudson.remoting.jnlp.Main$CuiListener status
INFO: Server didn't accept the handshake: Disabled protocol:Protocol:JNLP3-connect
Feb 02, 2017 6:09:36 PM hudson.remoting.jnlp.Main$CuiListener status
INFO: Connecting to xxxxxx:50000
Feb 02, 2017 6:09:36 PM hudson.remoting.jnlp.Main$CuiListener status
INFO: Trying protocol: JNLP2-connect
Feb 02, 2017 6:09:36 PM hudson.remoting.jnlp.Main$CuiListener status
INFO: Connected
..............
[stack here]

Could you help me?