The only ports you should need to allow outbound are the following:
udp/53 (dns queries to look up hostname)
tcp/443 (ssl update page)
You do not need to open any ports inbound. If you are filtering on the output chain you might need some established / related rules to allow the replies to router generated traffic.