Webaccess and ports to POA's

We've had the WebAccess inside our network since 1998. We're moving it to the DMZ, very soon. I should know this, but I never had to think about it. Does Webaccess need SOAP ports open for all services POA's, or just those specified in the config?