It connects from your local computer to CF, just like a locally-installed client would. But if the SSH port (22) isn't blocked, you can use another box as in intermediary, which is what I did at my old job. I'd be happy to give you an account on one of my servers if you want to try that route.