At a minimum 5985 (WinRM) must be forwarded for Vagrant to work.