I have FreeIPA setup on CentOS 7 in AWS.  However we are looking to lock down communication over our VPN tunnel.  Trying to do some research to see what ports I need.  I've gotten most of them, 80,443,88,464,389,636,123.  I have it setup to allow UDP/TCP for both sides.  However in the amazon security groups I have found that if I remove 0.0.0.0/0 from the inbound I lose communication to the remote FreeIPA servers.  However the server in AWS can talk back.  

This email thread might not be relevant here but I wanted to see what kind of response i'd get.

Are there ports similar to what needs to be opened for AD ?

I found this on Amazon's website:

Thanks,
Andrew