When you install the forwarder just specify the DS server & Port like this:
msiexec.exe /i Splunk.msi DEPLOYMENT_SERVER=host:port /quiet
Then you should create an outputs App on your DS that will push just an outputs.conf to all your Forwarders.
makes sense. however, if I want to lock down a port on the forwarder sitting in DMZ to use a port to communicate to 8089 on deployment server and to communicate to 9997 on indexers how do I do that? Where do I specify the port on the forwarder to communicate to DS and IDX?
the deploymentclient.conf will have the server:port in it and the outputs.conf will have the indexer server:port in it too. Additionally the indexer and DS are only listening on those same ports.