I do not use gLiveView, but yes as @Alexd1985 wrote each BP will have one outgoing connection to relay, that what you put in topology file of BP and one incoming connection from relay, because again you put in topology file of relay BP there. Outgoing connections are from ephemeral ports or high random port to port what you configure.
Usually you allow all outgoing traffic, that why it is not blocked by FW, but technically you can block outgoing traffic too.
Here short manual:
Additionally your FW has following rule:
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
This means that we do allow connections what were established, basically if we opened connection from BP to relay port 64102, then we will accept replies from any port from relay. That why your BP allows connection at port 40431 for example.