Migration Endpoint - firewall settings - required open ports?

In a newly created hybrid Exchange 2013/Exchange Online environment, I am trying to migrate the first mailbox from on-premise to the cloud. For this, I open portal.office.com and navigate into ECP -> Recipients -> Migration. I Select "+" -> Migrate to Exchange Online, which opens a "new Migration Batch" window, lets me select the user to migrate and provide the Administrator credentials.

Then, the error I get is

We couldn't detect your server settings. Please enter them. AutoDiscover failed with a configuration error: The migration service failed to detect the migration endpoint using the Autodiscover service. Consider using the Exchange Remote Coectivity Analyzer (https://testexchangecoectivity.com) to diagnose the coectivity issues.

When I now enter the FQDN name or the IP address of our firewall router, I get the error(s)

The coection to server autodiscover.ourdomain.com could not be established.
The coection to server 12.34.56.78 could not be established.

The router firewall only lets HTTPS (443) and SMTP (25) through to the Exchange server, so I guess we are just missing a port here.

Is this the correct assumption, and which port(s) could that be?