What port number does Profile Manager Device Enrollment listen at?

I've got Profile Manager up and running smoothly with all the right certificates, push notifications, etc.

However, if I try to enroll a device from outside the LAN, it says server not available. However, it's fine within the LAN.

So what port number(s) do I need to forward/map to get this working correctly from outside the LAN?