Required on all software versions:
Heartbeat: TCP 443 - / (currently)
API: TCP 443 - / multiple ip addresses
Push (GCM/FCM): TCP 5228-5230, 443 - outbound - multiple ip addresses

Storage: TCP 443 -

Note: If your organization has a firewall that restricts the traffic to or from the Internet, you need to configure it to allow connectivity with GCM in order for your GCM client apps to receive messages. The ports to open are: 5228, 5229, and 5230. GCM typically only uses 5228, but it sometimes uses 5229 and 5230. GCM doesn't provide specific IPs, so you should allow your firewall to accept outgoing connections to all IP addresses contained in the IP blocks listed in Google's ASN of 15169.

This article was helpful for 3 people. Is this article helpful for you?