To allow the communication and management of your Datto appliance, request the following rules:

Assuming xx.xx.xx.xx is the IP address of your appliance.

For IP xx.xx.xx.xx allow ports 80, 443, 2200-2250,22, UDP 123 to have access to IP's:

8.8.8.8

27.111.214.77

68.169.200.209

207.223.32.251

88.84.155.190

8.34.181.199/32

8.34.176.0/24

47.19.105.0/24

162.244.87.51

162.244.85.60

162.244.87.37/32 port5044

162.244.87.38/32 port5044

162.244.87.0/24 port 443 and port 80

198.49.95.0/24

198.137.225.0/24 port 80 and port 2200-2250

198.137.226.0/24

206.201.136.0/24 port 80

206.201.137.0/24

27.111.249.0/24

162.244.87.109 

23.202.72.84

8.34.181.249 

198.135.233.13

91.189.88.0 through 91.189.95.255

8.34.165.0/24

8.34.181.0/24

192.30.37.0/24

198.49.95.0/24

162.244.84.0/24

162.244.85.0/24

206.201.139.0/24

70.33.207.240/28

70.33.207.241/28

70.33.242.128/25

198.137.227.0/24

206.201.134.0/24

176.74.168.192/26

66.155.20.0/24

185.217.56.0/24

185.217.58.0/24

198.137.225.0/24

185.217.57.0/24

185.217.59.0/24

27.111.249.128/25

103.109.129.0/24

198.137.226.0/24

103.109.128.0/24

Also allow xx.xx.xx.xx to resolve DNS to 8.8.8.8.

And to allow the communication between the Datto appliance and the servers that will be backed up, request the following:

Between IP xx.xx.xx.xx and the whole vlan (or specific IPs), open TCP ports: 25566, 25568, 3260, 3262, 3389, 139, 445. This rule should be bidirectional, because source could be either way.