Those ports should be outbound only, not inbound. It sounds counterintuitive, but Apple designed it specifically this way; the server initiates the connection with Apple, and then Apple sends the data back to the server over that connection. It works the same way with the iOS and Mac managed clients, but via port 443. I've seen a lot of documentation that was inconclusive, but we don't have any of those ports open internally, and our environment works fine, and receives push notifications rather quickly.
