So far I found these ports to be open from the outside world of cellc:
tcp port 22 (ssh)
tcp port 25 (smtp)
tcp port 53 (dns)
tcp port 80 (http)
tcp port 110 (pop3)
what gets me is that tcp port 445 is closed from outside but open to internal clients of cellc. So I'm getting a lot of spam from windows clients/worms to try and connect to my port 445. So if cellc is trying to help me, their not because all their cellc infected clients are wasting my bandwidth.
I would then rather just live with an unrestricted apn. Or at least give me tcp port 443 access and I'll be happy for now.