When filtering IPs, make sure you are allowing inbound/outbound traffic on port 443 (and port 80 if your network security guidelines allow it) from the following IPs

The NetCommunity Datacenter iPs:
- US clients:
Boston: 205.139.103.1
Orange County: 209.67.132.1

- For Canadian clients:  Vancouver:
204.92.98.65 – 252 (This range of addresses must be open)

Reference: How to configure Firewall to specific IP addresses for NetCommunity and The Raisers Edge

Payment Services: 
See article: IP Addresses and hostnames for the Blackbaud Payment Service, Blackbaud Checkout (formerly Blackbaud Secure Payments) and Blackbaud Merchant Services for the most up to date list.

BBNC Services (eMail): 
See article: What IP addresses are used by Blackbaud NetCommunity, Internet Solutions, Online Express, and Altru to send emails? for the most up to date list.
You may also need to allow the following iPs to ensure emails send properly:
216.39.103.68
206.31.252.86


Also make sure you are allowing inbound/outbound connection on port 443 (and port 80 if your network security guidelines allow it) for the iP address tied to your Domain name.
Your Domain name is associated to the bbcust URL for your site (This is critical for the plugin to be able to connect to NetCommunity database)

- Your bbcust URL is - xxxx.bbnc.bbcust.com, where 'xxxx' is your site ID.

To get the IP address associated with you Domain name/bbcust URL:
  1. Go to: MXToolbox.
  2. Click: DNS Lookup on the far right of the black menu.
  3. Enter your bbcust URL in the blank and click DNS Lookup.
  4. This should return an "A" record entry that shows the bbcust URL as the Domain Name and its associated iP Address.
  5. Add this to your firewall exceptions.