Here is the list of ports used by Headwind MDM:
80/TCP - HTTP port is used by LetsEncrypt to renew SSL certificates (used once per week, not required if you're using commercial certificates);
443/TCP - HTTPS traffic (note that Tomcat works on port 8443 so a port redirection is set up on the server);
31000/TCP - this port is used to send instant Push notifications to devices.
If you are additionally using the Headwind Remote module, you need to open additional ports, see details here.