Sounds like a most worthwhile aim :-D

I don't really know anything about Beowolf (must have slept through Old English and Saxon poetry) but I assume the nodes have some form of communication, presumably your average TCP/IP LAN. If you don't use NAT to allow any node external access through the master node, then perhaps you can achieve a similar effect using a proxy server on the master node?

To crunch for WCG, you must use a Linux based OS on your nodes. Unix won't work.

A local proxy's probably the best way to do it, then. You can restrict it to *.worldcommunitygrid.org - remember to support SSL connections.

A few words about deployment: BOINC is easy to distribute among computers. The key file is account_www.worldcommunitygrid.org.xml - add this file to a vanilla install, and each host will already be attached to WCG under your account.

While you can just copy an entire running installation, it's better not to, since then BOINC doesn't have to correct all the duplicate host IDs.

maybe certain ports need enabling 443,31416,1043. Also secure.worldcommunitygrid.org, though it seems to sit on the same IP address?

Then of course there is this thing we do that has been added to the official english dictionary.....that generates [pkg-boinc-devel] "Cannot resolve hostname problem"

EDIT 7.18.06 14:31CET. Reading the WCG Firewall help section there also appears to be a server.worldcommunitygrid.org. Pinged it @ 129.33.89.134. Have added this to my firewall as again the BOINC front end froze, while the science happily continued....doubt it helps as it is local RPC comms that seems to hang up at undefined moments. I'm stumped why, but suspending the firewall everytime resumes the BOINCmgr.

The theory's sound.

I suggest you stick with NAT rather than try a fancy proxy configuration. You should have no trouble setting up a network, and any firewall exceptions you need will be the same as for any Linux box.