You need port 8080 TCP and 3478 UDP at a minimum on the controller computer. Port 8080 makes them show up in the controller, and 3478 keeps one from seeing STUN errors. https://community.ui.com/questions/Windows-Firewall-blocking-AP-Controller-communication-even-with-rules-in-place/65453356-9751-43b8-ada2-460bd914ab9b