We have just the thing for that!
You can find the firewall docs for all Chef Server installation types(topologies) over here: http://docs.chef.io/server/server_firewalls_and_ports.html
The key to the firewall docs is the perspective. If the doc is for configuring a firewall for a Frontend, then it is referencing the ports that need to be open from Chef Client -> Frontend. If the doc is referencing configuration of a Backend then it will speak about the ports that must be open to allow traffic to flow Frontend -> Backend.
When the docs mention that the value of a port is "external yes", the implication is "You must configure the firewall to allow this traffic to pass".