The retrieving of the WebUI Common site is the first step of the initialization of the WebUI. As long as that fails, there’s basically no WebUI yet to connect to. That’s why nothing is listening on 80/443, and no log file is there.
During the initialization, the WebUI is expected to connect to the BESRootServer (through ports 52311 and 52315), retrieve the content of the WebUI Common site first, and then the content of some more WebUI sites (which sites depends on license entitlements).
In a further initialization phase, WebUI will also need to access the BFEnterprise database through the DB2 port, so possible firewall on DB2 system should allow the DB2 port.
So overall, from a WebUI standpoint, the firewall of the BESRootServer system should allow ports 52311 and 52315, and the firewall of the DB2 system should allow port 50000 (assuming default).