Converter server needs port 443 if accessed remotely by its client, otherwise it acts only as client in this scenario.
Converter client is never a server and need no open ports.
Source machine needs port 22 - it will be accessed over SSH by helper VM and Converter server.
ESX needs port 902 to be accessed by Converter server (for mounting the helper ISO; It doesn't actually need port 903). It needs 443 if accessed directly (w/o vCenter server) by Converter server.
vCenter (if used) needs 443 to be accessed by Converter server.
Helper VM (which is also the destination VM) needs 443. It will be accessed by converter server.
See user guide p.13 to help visualize the communications
HTH
Plamen