Is there any client that can run behind a firewall? I tried bitcoin-qt and Electrum and neither could work because of blocked ports. I know I could use a web-hosted solution but I'd prefer a local wallet.dat.
You'll need to open up something to let the traffic your client needs through. For instance MultiBit needs port 80 and 8333 open to do some HTTP gets and to make the bitcoind connections, respectively.
The other clients will have similar port needs.
Alternatively you could set up a SOCKS 4/5 proxy together with an SSH port forwarding tunnel so that your local client could make connections out. Then you would have a specific connection from your machine to the SSH server but nothing else would be open. I use this setup on my Mac to encrypt my traffic and MultiBit works fine.
In principle, electrum supports this. In practice however, only electrum.no-ip.org seems to accept HTTP or HTTPS on the standard ports and it can rarely be reached. Judging from the host name it is a machine connected to the internet through a residential internet connection with a dynamic IP; not exactly a heavy-duty server.