What ports need to be opened to play multiplayer reliably?

So I'm trying to configure my firewall to open the right ports needed to play multiplayer.

According to Ubisoft's Support page:

...you will need to configure your router or firewall to allow the following 
network ports for the best possible connection:

ACR Ports:
UDP: 21200, 7959, 3074

Uplay Launcher:
TCP: 80, 443, 13000, 13005, 13200

Achievements
UDP & TCP: 14001

But it isn't clear in what direction and which applications need the ports.

I allowed all outgoing and those incoming UDP ports for ACR but I'm still getting BAD upload and STRICT NAT classification.

I temporarily enabled DMZ on my firewall and inspecting my connections when refreshing my online status, I'm seeing these requests for multiplayer:

0.0.0.0:54466 -> 127.0.0.1:45301 (UDP)
localhost:21200 -> 216.98.51.139:28783 (UDP) //ubisoft servers
localhost:21200 -> 216.98.51.140:28783 (UDP)

And these active connections:

localhost:12001 -> 216.240.146.139:12001 (UDP)
localhost:3074 -> 216.240.146.139:12001 (UDP)
localhost:3074 -> 216.240.146.139:12011 (UDP)

(nothing is coming in or out from UPlay at this point)

I want to hold off on playing until I can get the right ports set up so I won't have to worry about it later. AFAIK, I'm going to have to open something incoming if I want to/end up playing as host but I don't know what yet. No chance of dedicated servers here.

What am I missing here? Do I even need to open any incoming ports?

So it looks like I do need to have UPnP enabled. After having it enabled and restarting my computer, the NAT classification is now declared open. I can even see the entries to Ubisoft in the forwarding table.

Viewing the logs, I've determined that I only really need to open these ports at a minimum for normal play:

ACRSP.exe

Outgoing:
    TCP 80 (remote)
    UDP 3074 (local)

Incoming:
    None

ACRMP.exe

Outgoing:
    UDP 7959 (local)
    UDP 3074 (local)
    UDP 21200 (local)

Incoming:
    UDP 7959 (local)

UbisoftGameLauncher.exe

Outgoing:
    TCP 80 (remote)
    TCP 443 (remote)
    TCP 13000 (remote)

Incoming:
    None

I haven't figured out what affects the upload stat yet. I could probably ignore that for now as I don't have any plans to use the ingame chat.