What Ports for RDS Gateway in DMZ?

Hi Everyone,

I'm really struggling with this one.  I have moved my RDS gateway and Azure MFA/NPS servers from the LAN into the DMZ.  I now have firewall rules issues, as when the firewall is open everything works great, but I need to lock it down to only the required ports.  Does anyone know which ones to open.  I've tried 443/3389/RPC and a bunch of others but unless I open everything it fails.  In fact, I don't even get the MFA call from Microsoft so it's failing at the first step.

Servers in DMZ

GW1

GW2

NPS1 (Azure MFA plugin installed)

NPS2 (Azure MFA plugin installed)

RODC

Thanks!!!!