To ensure that users can access terminal servers through a firewall, you need to open the following firewall ports for sending and receiving TCP/IP packets:
3389: The RDP client and Windows Terminal Services send and receive packets via this port. This is the standard RDP port. If you’ve used a non-standard RDP port, open that port.
1494 (in only): The ICA client sends packets to Citrix MetaFrame servers through this port. This is the standard ICA port. If you’ve used a non-standard ICA port, open that port. For more information about Citrix firewall requirements, see the Citrix documentation.
1023 and above (out only): Citrix MetaFrame servers send packets to ICA clients through these ports. For more information about Citrix firewall requirements, see the Citrix documentation.