I tried installing Gentoo Prefix on a supercomputer whose firewall that blocks access to nearly the entire internet, which caused numerous fetch failures. I tried using port forwarding, setting GENTOO_MIRRORS and setting FEATURES=force-mirror, but bad TCP checksums caused the majority of connection attempts through the tunnel to fail and portage fell-back to trying to access various mirror sites that I had not specified. That triggered the Intrusion Detection System, causing the security team to block my IP address. I have notified them of what happened and I am waiting for a response. However, such incidents could be avoided if portage could output a list of files that it needs to install software so that they can be manually fetched from the appropriate mirrors.
The best thing that's available now is emerge --fetch --pretend. *** This bug has been marked as a duplicate of bug 358923 ***