Necessary Firewallports if SharePoint is in a DMZ using a One-Way-Trust

Direction: ALL SharePoint Servers --> Domain Controllers in Trusted Domain

53/TCP/UDP --> DNS
88/TCP/UDP --> Kerberos
135/TCP --> RPC
389/TCP/UDP --> LDAP
3286/TCP --> LDAP GC

Direction: ALL SharePoint Servers --> SMTP Servers in Trusted Domain

25/TCP --> SMTP


Direction: Clients --> ALL SharePoint FrontEnd Servers
80 or 443 /TCP

Direction: Admin Clients --> ALL SharePoint Application Servers
e.g.:9090/TCP for Central Administration