...
The Razor2 system requires outbound access to servers on tcp port 2703 in general (the servers are, at the moment, on the class C 66.151.150.0/24, but allowing only access to those machines would be too restrictive).
It also requires outbound access to those servers on tcp port 7.
It does not require that the razor servers connect to any open ports on your machine. All the connections are typical TCP client connections (ie: from a local port >1023) to port 7 or port 2703 on the razor server.
It does not use UDP or ICMP, with the exception of performing DNS lookups for server discovery.
If you are still using razor1, upgrade, as Spamassassin does not support this now. Razor1 made outbound connections to servers on tcp port 2702.
...