I don't have an infrastructure diagram, but here is some highlights of the ports you will need to open to establish the communication between Sitecore and the modules/services.
WFFM & EXM: The Sitecore will use a SMTP server to send emails, and will depends how the email server is set. The standard port for SMTP is 587. In this case your SMTP server needs to allow connections on TCP/587.
SQL Server: The standard port for SQL Server is 1433 and you will need a rule at the SQL Server to allow connections on TCP/1433
Coveo Cloud: Coveo Cloud is already set to accept connections on its ports and if you are blocking outbound connections, then you'll need to allow outbound connections to the follow IPs:
BONUS - Local Coveo If you are interested in know the ports used by the Coveo Platform, please click here for more details. Here are the ports: TCP/52800; TCP/52810; TCP/8081; TCP/8080; TCP/1980; TCP/56000; TCP/5682; TCP/52580; TCP/15672
AD Module: Active Directory listens on port 389 and for Active Directory Profile Provider port 445, so your AD needs to accept connections on these ports.
mLAB: First of all you'll need to find your database connection info by following the steps
. Log in to the mLab management portal
. Navigate to the MongoDB deployment that you wish to connect to
. At the top of the screen, you will see a box with the connection information
In the picture above, notice that the server address is ds012345.mlab.com and the port used is 56789, which means every mLAB setup is unique and hostname and port are different from deployment to deployment. Using the picture as an example, you will need to allow connections to the port 56789
BONUS - mLAB Dedicated plans offer the ability for you to define custom firewall rules so that your database only allows network access from your application infrastructure. By doing it, you will have the option to add the Sitecore box public IP, and you guarantee that ONLY that Sitecore box will be able to access your mLAB MongoDB deployment.