You need to configure the firewall to allow connectivity with GCM in order for your Android devices to receive messages. The ports that you have to open on your firewall are: 5228, 5229, and 5230 TCP. GCM typically only uses 5228, but ports 5229 and 5230 are also used sometimes. GCM doesn't provide specific IPs, so you should allow your firewall to allow outgoing connections to all IP addresses contained in the IP blocks listed in Google's ASN of 15169.

Push providers, iOS devices, and Mac computers are often behind firewalls. To send push notifications, you will need to allow inbound and outbound TCP packets on port 2195. To reach the feedback service, you will need to allow inbound and outbound TCP packets on port 2196. Devices and computers connecting to the push service over Wi-Fi will need to allow inbound and outbound TCP packets through port 5223.

The IP address range for the push service is subject to change. The reason being that providers will connect by hostname, rather than IP address. The push service uses a load balancing scheme that yields a different IP address for the same hostname. However, the entire 17.0.0.0/8 address block is assigned to Apple, so you can specify that range in your firewall rules.