The ports SRCDS officially requires are:
27015 TCP/UDP (game transmission, pings and RCON)
27020 UDP (SourceTV transmission)
SRCDS has also been spotted opening connections on 27005 and 51840 UDP, but these may be outbound only.
Tip: Pinging your own server will fail with some routers and/or ISPs. The most reliable way to test whether your connection is open is either to get a friend to try connecting, or to install the Microsoft Network Monitor (apply the filter Udp.Port == 27015) and watch for requests coming in from random people around the world. Note that the heartbeats you will see being sent to the two master servers do not mean that the connection is open.
Note: A residential internet connection may not have the upload capacity to support large games.
Note: Using service providers which use CGNAT (such as mobile providers or an increasing amount of residential providers) may make it impossible to host any kind of server.
Note: Servers won't respond to queries until a map is loaded.
https://developer.valvesoftware.com/wiki/Source_Dedicated_Server