Bacula uses three primary tcp ports to function 9101 (dir), 9102 (FD), and 9103(SD).
For a bacula4hosts deployment, tcp 9102 on the servers you are backing up (FDs) must be open to our directors that will connect from source ip: 188.8.131.52/24 or 184.108.40.206/24. Likewise, your storage server (SD) must allow connections to tcp9103 from 220.127.116.11/24 and 18.104.22.168/24 as well. Furthermore, you need to make sure that tcp9102 and tcp9103 are open between the respective server (FD) and storage (SD) that are being backed up.
Servers that are being backed up (FD for short, otherwise known as File Daemons):
Ports to be opened ingress/egress: tcp9102, egress: tcp9103, tcp80/443(for API, ssl/443 by default), SSH for auto-install on *nix
Allowed source ips: 22.214.171.124/24, 126.96.36.199/24, and your storage daemon IPs to access tcp9102
Storage Servers (SD for short, otherwise known as Storage Daemons):
Ports to be opened ingress/egress: tcp9103, SSH for auto-storage install
Allowed source ips: 188.8.131.52/24, 184.108.40.206/24, and your file daemon IPs to access tcp9103