My own PBX is in a (real) DMZ and I have rules in my firewall (not the FreePBX one, the one which protects my whole network) to allow:
Outbound SMTP (port 25 TCP)
Outbound SIP traffic (the usual SIP ports + all UDP for RTP traffic)
Outbound HTTP (port 80 TCP)
Outbound HTTPS (port 443 TCP)
Outbound NTP (port 123 UDP)
Outbound GPG (port 11371 TCP)
and of course DNS (UDP and TCP port 53) but this is handled a little differently than the rest…
SMTP is for the email notifications, NTP for time synchronization and GPG for the module signatures IIRC…
If your PBX is in the same situation (a DMZ that doesn’t allow all outbound traffic by default) you would need to open the same ports…
Good luck and have a nice day!
Nick