When running, my QueueManager opens the following ports.
I may assume they are used by both the PoserWorkstation and the EC2, and that the VPN must permit these kinds of traffic, both ways:
tcp 11527, tcp 4418, udp 11523, udp 11423.

(Earlier posters have confirmed that Routers won't forward Broadcast UDP traffic. Otherwise, a destination of 255.255.255.255 would send the broadcast to every IP device on the planet.)

The use of QueueManager over different networks (i.e. 'over the internet', 'in the cloud') would be made easier if it provided a means to nominate the addresses of the slave renderers; thus negating any need to use UDP.

Additional comment:
Although I have only casually looked at the networking side of Poser, I note that TCP/11527 appears to be interpreted as an incoming job.
e.g:   TELNET 127.0.0.1 11527  (then type something), then look at the QM panel.