You can do this behind a firewall, but then you have to instruct ant to use a proxy. Maybe -autoproxy works for you, but it didn't on my system. I had to specify -Dhttp[s].proxyHost and -Dhttp[s].proxyPort. You can put these properties in ANT_OPTS and they will be picked up automatically.
Note that the first part of the ant target uses HTTP, whereas the last part (fetching the release notes) uses HTTPS. This means you have to specify a proxy for both protocols.
Committed to trunk with revision 1434599.