I'm working in an environment where web servers are sitting in a DMZ that only allows incoming HTTP traffic - no outgoing traffic at all is permitted without going through numerous administrative channels to get ports opened. I do however have full administrative access to the server only.

I could deploy a tentacle in this scenario if I had some kind of web resource that acted as a proxy for a listening tentacle. Octopus would manage the tentacle via <site>/octopus-deploy.axd instead of through the usual listen port.