To receive notifications, your iOS device needs to establish a connection with Apple's servers. This connection is made over the following ports: 

• TCP port 5223 to communicate with APNs.
• TCP port 443 or 2197 to send notifications to APNs.
• TCP port 443 is required during device activation, and afterwards for fallback (on Wi-Fi only) if devices can't reach APNs on port 5223.

The APNs servers use load balancing, so your devices don't always connect to the same public IP address for notifications. It's best to let your device access these ports on the entire 17.0.0.0/8 address block, which is assigned to Apple.

You can read more about this on Apple's support portal.