What connections do I need to allow through a firewall for Zotero to work properly?
If Zotero is being used, it should be given the same access that browsers on the system have or much of its functionality will be broken.
Beyond zotero.org domains, various core functionality depends on internet access that is unrestricted beyond standard content blocking: file saving (from any site a user saves from), Add Item by Identifier, PDF retrieval, PDF metadata retrieval, metadata updating, etc. Because of these required connections, it's not possible to limit Zotero's internet access to specific domains.
If you're having trouble allowing Zotero to connect through a firewall or proxy, see Connection Error.