I'm working on the master config...
One thing it needs is the (domain name and) port number where buildbot's own http server will be visible. Default is 8010. I guess it just needs to be open to the WAN and that's it.
I think 8010 and 10012 are not filtered on that network.