:DSLINE/remote hello will contact the target system on TCP port 1537 or 1570. The former is likely to be used for 3000-to-3000 connections while newer PC-based termulators are more likely to use the latter. So you must permit 1537/1570 outbound. If you expect to :DSLINE back, you must permit them inbound as well. Note that DSCOPY, RFA, RPM, and other NS services require specific ports as well in the same general numeric range.