Ports require to do yum update?

[jep at obrien-pifer.com (James Pifer)]

I have a couple CentOS boxes running in our DMZ and although they are
running behind a firewall, I'm also running iptables. One thing I cannot
do it yum update. What ports are required for this? I have outbound http
open and I can browse to sites using firefox. 

If I run an ethereal scan the process seems to stop with DNS queries,
but I can resolve mirrorlist.centos.org without a problem. Anyone know
what the problem could be?

If I stop iptables everything works of course.

Thanks,
James