Replication connections to SQL Server use the typical regular Database Engine ports (TCP port 1433 for the default instance, etc.) Web synchronization and FTP/UNC access for replication snapshot require additional ports to be opened on the firewall. To transfer initial data and schema from one location to another, replication can use FTP (TCP port 21), or sync over HTTP (TCP port 80) or File and Print Sharing (TCP port 137,138, or 139).
What this doesn't state is whether everything but 1433 can be closed once the initial snapshot has been restored on the subscribers. Are the ports required to be open permanently? I'm airing towards "yes they do" but ideally I need as much closed as possible.
--Edit Sorry I forgot to say that its a pull replication, with the distributor sitting on the publisher server. I'm interested in what needs to be open between the distributor and the subscriber.