At the moment there is no ssl tunnel other than to the bamboo server.
We are planning to implement a tunneled connection to the vcs server http://jira.atlassian.com/browse/BAM-3119

Until then we could add a vpn client. It ccould be used as an option to bridge the gap and land the elastic agent on a local network.