Authentication Server - Protocol TCP outbound from any local address and port to any remote address port range 7001 - 7002
WON Server - Protocol TCP outbound from any local address and port to any remote address port 6003
WON Master In - Protocol UDP inbound and outbound from any local address and port to any remote address port range 27010 - 27015
Chat Server (optional) - Protocol UDP and TCP outbound from any local address and port to any remote address to port range 19000 - 19750
Game Servers - Protocol UDP inbound and outbound from any local address and port to any remote address to port range 27000 -27050
Half-Life Launcher - Protocol UDP inbound and outbound from local single port 27015 to single remote address (PC on LAN) 192.168.x.x and any remote port.
The last entry is a single machine on my LAN; it's some kind of loop back I think. Kerio kept prompting me to allow it, so I did since it was my own machine.
For a Linksys Router I use port triggering. Open the Linksys configuration web page then Select the advanced tab. Select the port forwarding tab and select port triggering to open the following ports;
Application Name hl.exe Trigger port range 6000 - 8000, Incoming ports range 6000 - 8000.
Application Name hl.exe Trigger port range 27000 - 28000, Incoming port range 27000 - 28000.