To trigger a job or an order on a remote JobScheduler you need to open the configured JobScheduler port at the remote side (port 4455 in the example below) and ports 59999 and lower at the client side:
Only incoming ports should be restricted when configuring a firewall for JobScheduler (see the above diagram). The outgoing ports are allocated by operating system functions at random and therefore it is not worthwhile restricting them in the firewall.
The maximum number of remote processes that can run in parallel should be considered when setting the range of the ports to be opened below 59999. It is also important to consider that operating systems generally take around two minutes before they finally release a port and allow it to be used to make a new TCP connection to be made.