This has probably been asked before, but I couldn't find an answer.
My old posting ( CM was gateway and also -the only one- submit node ) https://lists.cs.wisc.edu/archive/condor-users/pre-2004-June/msg00247.shtml
HTH ? walter
btw: in /etc/hosts on the private nodes you must define the CM with the correct external IP