The client needs ICMP and tcp/52311 to the relay.
Optionally, the relay should have udp/52311 to the client; this allows the relay to inform the client when there is new content or actions, so you get a faster response from clients.
If udp/52311 from relay to client cannot be opened, or the traffic crosses NAT or Internet, there are Command Polling options you may wish to apply on the client for more frequent checks for updated content/actions, as the default is to check every 12 hours.