What ports do I need open for self-hosting SubsiMail behind a firewall?

Inbound: just 443 (and 80 if you want automatic HTTP→HTTPS redirect/Let's Encrypt renewal) for the web dashboard and API. Outbound: 587 (or 465, depending on your SMTP provider) for sending mail, and standard 443 outbound for any webhook/integration calls. You generally don't need any other inbound ports open — the database and background workers run locally on the same box and don't need external access.

Yeah, quickest way is telnet smtp.gmail.com 587 (or whatever host you're using) from the server itself — if it connects and shows an SMTP banner, you're good. If it hangs or refuses, that's your firewall blocking outbound 587, and you'll need to add an allow rule for it specifically since many corporate firewalls block outbound mail ports by default to prevent spam relay abuse.