diff --git a/changelog.html b/changelog.html
index ab763a42a0..8c01918299 100644
--- a/changelog.html
+++ b/changelog.html
@@ -58,6 +58,8 @@ Upcoming changes</a>
   <li class=bug>
     Search box did not work well inside folders.
     (<a href="https://issues.jenkins-ci.org/browse/JENKINS-24433">issue 24433</a>)
+  <li class=rfe>
+    Advertised TCP slave agent port number is made tweakable.
 </ul>
 </div><!--=TRUNK-END=-->
 <h3><a name=v1.610>What's new in 1.610</a> (2015/04/19)</h3>
diff --git a/core/src/main/java/hudson/Functions.java b/core/src/main/java/hudson/Functions.java
index 6c4377652a..c6f473be4f 100644
--- a/core/src/main/java/hudson/Functions.java
+++ b/core/src/main/java/hudson/Functions.java
@@ -1887,9 +1887,10 @@ public class Functions {
 
             TcpSlaveAgentListener tal = j.tcpSlaveAgentListener;
             if (tal !=null) {
-                rsp.setIntHeader("X-Hudson-CLI-Port", tal.getPort());
-                rsp.setIntHeader("X-Jenkins-CLI-Port", tal.getPort());
-                rsp.setIntHeader("X-Jenkins-CLI2-Port", tal.getPort());
+                int p = TcpSlaveAgentListener.CLI_PORT !=null ? TcpSlaveAgentListener.CLI_PORT : tal.getPort();
+                rsp.setIntHeader("X-Hudson-CLI-Port", p);
+                rsp.setIntHeader("X-Jenkins-CLI-Port", p);
+                rsp.setIntHeader("X-Jenkins-CLI2-Port", p);
                 rsp.setHeader("X-Jenkins-CLI-Host", TcpSlaveAgentListener.CLI_HOST_NAME);
             }
         }
diff --git a/core/src/main/java/hudson/TcpSlaveAgentListener.java b/core/src/main/java/hudson/TcpSlaveAgentListener.java
index 059e2af965..46d99076ae 100644
--- a/core/src/main/java/hudson/TcpSlaveAgentListener.java
+++ b/core/src/main/java/hudson/TcpSlaveAgentListener.java
@@ -204,6 +204,18 @@ public final class TcpSlaveAgentListener extends Thread {
      * TODO: think about how to expose this (including whether this needs to be exposed at all.)
      */
     public static String CLI_HOST_NAME = System.getProperty(TcpSlaveAgentListener.class.getName()+".hostName");
+
+    /**
+     * Port number that we advertise the CLI client to connect to.
+     * This is primarily for the case where the port that Jenkins runs is different from the port
+     * that external world should connect to, because of the presence of NAT / port-forwarding / TCP reverse
+     * proxy.
+     *
+     * If left to null, fall back to {@link #getPort()}
+     *
+     * @since 1.611
+     */
+    public static Integer CLI_PORT = Integer.getInteger(TcpSlaveAgentListener.class.getName()+".port");
 }
 
 /*