According to the DA-KISS firewall the following TCP ports should be open for incoming connections:
20 21 22 25 53 80 110 123 143 443 2222 3306 6277 8443 10000
and for outgoing connections:
20 21 22 25 37 43 53 80 113 443 2222 3306 6277
As far as I know there is no special port specifically for checking the license. It just uses port 80.