Supporting this should allow customers with behind-the-firewall installations of SCMs to define tunnels which let them use EC2 easily without customization.

to allow me to connect to network resource inside the firewall,
on my homegrown ec2 build environment I use:
1 tsocks, a transparent socket proxy
2 an openssh DynamicProxy that I open back to the originating computer
3 a RemoteForward to "localhost:22" on the outgoing ssh connection to allow the ec2 machine to connect back to me to open the DynamicProxy

installing VPN software on the instance to gain access back to our office to download source code (we aren't on a public repository). When doing test runs of our build we had the VPN up and it ran fine,
https://support.atlassian.com/browse/BSP-1924?focusedCommentId=558046&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#action_558046