For reference, what ports would need to be open on the node to the internet in order to operate tunnelsats?
TCP 443, I suppose. TCP 80 as well? any more?
None. Since your node will initiate the tunnel client-sides to our servers, all LN related ports will go through the tunnel. So neither 443 (https) nor 80 (web) are required.