I'm assuming you're using MJS. This is what the documentation has to say:
BASE_PORT. The mdce_def file specifies and describes the ports required by the job manager and all workers. See the following file in the MATLAB installation used for each cluster process:
matlabroot/toolbox/distcomp/bin/mdce_def.sh (on UNIX operating systems) matlabroot\toolbox\distcomp\bin\mdce_def.bat (on Windows® operating systems)
in R2014a this file specifies the following:
# BASE_PORT: The base port of the mdce service.
# The mdce service will use as many ports as needed, starting with BASE_PORT.
# On a machine that runs a total of nJ job managers and nW workers, the mdce
# service reserves a total of 5+nJ+3*nW consecutive ports for its own use.
# All job managers and workers, even those on different hosts, that are going
# to work together must use the same base port, otherwise they will not be
# able to contact each other. In addition MPI communication will occur on ports
# starting at BASE_PORT+1000 and using up nW consecutive ports.
# Some operating systems are reluctant to immediately free TCP ports from the
# TIME_WAIT state for use by the same or other processes, so you should allow
# unfirewalled communication on 2*nW ports for MPI communications.
# To connect from MATLAB to a cluster with a non-default BASE_PORT, the
# value of BASE_PORT must be appended to the 'Host' property in the MJS
# cluster profile, in the form Hostname:BASE_PORT (e.g., myMJSHost:44001).
So as an example if you have a head node running 1 MJS with 4 workers you would need to give access from the client to the head node on ports 27350-27368 (18 ports = 5 + 1 + 3*4).
However, this is not sufficient to have a full working system, the head node also needs to be able to connect to server sockets created on the client to be able to transfer 'large' data, and the workers need to connect back to the client to form a parallel pool.
Again here's the documentation:
With the pctconfig function, you specify the ports used by the client. If the default ports
cannot be used, this function allows you to configure ports separately for communication with
the job scheduler and communication with pmode or a parallel pool.
These ports are set by default (in R2014a) to 27370-27470.
In summary, with the default configuration and 4 workers on the head node only, you should forward ports 27350-27368 from the client to the server, and you should forward ports 27370-27470 from the server to the client.
I should note that in our experience using SSH port forwarding to make this available outside your network does not perform well, but of course your mileage may vary.