Only the http port (in the above cam example, port 1033). They are set as TCP/UDP.
This is the same thing I've done for all my Axis, older SV3C, and Reolink, and they all work great (except these new SV3C B01POE-3MPL-A models) - inside & outside the network.
I'm even able to login to the cams...