Hi Clemens,
  I have to admit that I have been running out of ideas
why the wiki cannot get a connection while "curl" can.
 One last try: has the gateway connecting the local network to the internet an application
firewall or the like ?
 Something that sniffs user-agents for http connections and only allows "known
ones" ? 
Not to my knowledge, but see below
  The java client used by the XWiki installation wizard
might be emulated with:
    curl --user-agent "history" 
http://extensions.xwiki.org 
$ curl --user-agent "history" 
http://extensions.xwiki.org
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a
href="http://extensions.xwiki.org/xwiki/bin/view/Main/WebHome">…
</body></html>
$
  if this works, too, I have to admit I have no clue why
it does not work.
 (Btw, there should be an error message in the log files. Is there anything like that?)
In fact, there is a single error being printed to logs/catalina.out
/after/ I click the "continue" button in the first step of the
Distribution Manager:
[...]
2016-01-28 13:36:53,762 [Active Installs Ping Thread] WARN
a.i.c.ActiveInstallsPingThread - Failed to send Active Installation ping
to [
http://extensions.xwiki.org/activeinstalls]. Error =
[ConnectException: Connection timed out]. Will retry in [86400] seconds...
[...]
I don't know what an "Active Installation ping" is, but in fact while I
seem to be able to access this webpage:
$ curl 
http://extensions.xwiki.org/activeinstalls
{
   "status" : 200,
   "name" : "Bobster",
   "version" : {
     "number" : "1.1.1",
     "build_hash" : "f1585f096d3f3985e73456debdc1a0745f512bbc",
     "build_timestamp" : "2014-04-16T14:27:12Z",
     "build_snapshot" : false,
     "lucene_version" : "4.7"
   },
   "tagline" : "You Know, for Search"
}
$
I cannot `ping` it:
$ ping 
extensions.xwiki.org
PING 
www.xwiki.org (104.31.71.57) 56(84) bytes of data.
^C
--- 
www.xwiki.org ping statistics ---
76 packets transmitted, 0 received, 100% packet loss, time 75445ms
$
Does the Distribution Manager execute a real "ping" command even though
the webpages are accessible?  And if yes, how can I avoid this?  I doubt
that our networking dept. will adapt any gateway configuration to to
make a single software installation possible :-}
Cheers
Frank