Only the ports needed to perform remote administration: Remote Directory Access (625), server admin (687), Secure Shell (22)
WHY: These ports are enabled so that if you turn Firewall on remotely you will still be able to configure the server without blocking yourself out accidentally.