Let's cover both network related questions together:
Splunk forwarders send data to Splunk servers via TCP. All communication from the forwarders are initiated from the forwarders. If you are using the deployment server to manage your config, your Splunk forwarder will initiate a TCP connection on port 8089 to the deployment server to update its configuration. To forward log data, your Splunk forwarder initiates a connection to your indexer(s) on port 9997. You can remap these ports if necessary.
By permission, do you mean the user that the Splunk forwarder runs as? This will depend on if you are running your forwarders on unix or windows. Generally speaking, you can run as any user as long as that user has read/write access to the Splunk installation directory and has read access to the files you would like to index.
This document goes into detail about Windows permissions to run Splunk (including your forwarders): http://docs.splunk.com/Documentation/Splunk/6.3.2/Installation/ChoosetheuserSplunkshouldrunas
There is a similar document for Unix systems.
http://docs.splunk.com/Documentation/Splunk/6.3.2/Installation/RunSplunkasadifferentornon-rootuser