In separate network mode, the Connect gateway communicates with the cloud via the WAN port internet connection. The firewall of the WAN port allows outgoing connections only, and so the inbound port list and firewall configuration apply to the LAN port(s).
During the installation of an app, the relevant firewall settings are appended to the existing ones, which normally do not have to be modified manually. When it is necessary to open a range of ports, these are specified in Network > Firewall in the fields for UDP and TCP ports, respectively.
Open ports are listed in the bottom pane, including the ports used by the system and any additional ports opened (the allow-list).
For firewall recommendations and general settings, see Connect Gateway Cybersecurity guidelines, https://siemens.com/bt/download → ID: A6V12604901.