What is a list of host/port combinations to get the onion proxy (a.k.a. the Tor client) working securely?
This is about host/port combinations, not simply ports, as already described in the FAQ.
An example would be:
Tor needs to connect to localhost (127.0.0.1) at port 9150. And (made up IP-address) to a relay (123.123.123.45) at port 9001.
So that for example iptables
could be told,
iptables -A OUTPUT -d 127.0.0.1 --dport 9150 -m owner --uid-owner toruser -j ACCEPT
iptables -A OUTPUT -d 123.123.123.45 --dport 9001 -m owner --uid-owner toruser -j ACCEPT