what ports need to be open for netclient behind a fairly restrictive firewall?