I'm firewalling an Ubuntu Core 16.04 host: What port does snap package management require to be opened?

I spent ages Googling this: Snapcraft's docs don't detail the port nor did any other forums. Couldn't use tcpdump to derive the required port as snap find tcpdump gave no joy.

In the end, I had to packetsniff on the router. I'll provide the answer to hopefully save others firewalling Ubuntu Core hosts the same exercise in frustration...