In my experience, you don't need to open any ports.
geth will make outgoing connections, and this is enough to populate the local datastore.
Most firewalls only block incoming connections, and allow all kinds of outgoing connections. But if you do need to register outgoing connections explicitly, then you should allow:
- outgoing to 30303 TCP
- outgoing to 30303 UDP (for node discovery)
This should provide access to most nodes (those using default ports) but not nodes which have been configured to run on custom ports.
If you want other nodes to be able to open a connection to your node, allow:
- incoming to 30303 TCP
- incoming to 30303 UDP (for node discovery)
But I can't think why any remote node would want to connect to a light node.
Finally, if you want to use RPC from a remote machine, you may need to open the RPC port:
- incoming to 8545 TCP (but note security issue)
Note that doing this would allow anyone to use your port 8545. Therefore you should not unlock any wallet on your node, because someone could connect to port 8545 and transfer funds out of the wallet!