Probably in than email is outgoing means servers have to reply but beyond that, what's the bare minimum portlist that a public-facing webserver (iis7 with same-box sql) have to admit?
If you're using defaults -
80 is HTTP
443 is HTTPS
Just 80 if you don't use HTTPS
And then any ports you need open for remote access if you need it.
Just 80 is all you need for public web service. Add 443 if you have SSL in the mix.