By default, CIUMon listens on UDP port 5099. In order to connect to CIUMon from across a firewall, this port must be unblocked to allow UDP communication.
By default, in relay mode the firewall would need to be configured to allow the relay CIUMon to communicate with UDP port 5099 of the upstream CIUMon. In collector mode, the firewall would need to be configured to allow the upstream CIUMon to communicate with UDP port 6099 of the relay CIUMon. Note that the direction of traffic, and which computer is the one listening, changes depending on the mode. Also, the default port is different in collector mode -- this is because the relay CIUMon also listens for Hyperview requests on port 5099 by default, so a different port needs to be chosen for communication with the upstream CIUMon. However, you can easily configure CIUMon to use other port numbers instead of these defaults.