There is a stub in the new host menu where I intend to provide an option for specifying the port via the UI, but I haven't implemented it yet, and if you are doing firewall config, the INI file is a better option.
The first server you host should default to port 28000; if you host subsequent servers, they request a port from the OS if the user hasn't specified one. That is behavior dating back to the dawn of this project, and we could change if needed.
There is one other possible solution to all this, but it is complex. When a client wants to connect to a server, it asks for an arranged connection from the master server. The master has a pre-existing connection with clients and servers, and so it alerts the server that a client wants to connect. The server then sends a packet to the client (which usually fails), but that tricks the firewall into thinking that packets coming from the client are a response to the server's request, so the server's firewall lets the client's connect request packets through.
Ping packets, however, go directly from client to server, with no intervention from the master. I'm hoping (someday) do have ping packets initially go via the master to open the connection, much as game connection packets do. While that scheme may not work 100% of the time, it would reduce the number of pingTimeOut servers we see, and would not require any firewall configuration.
At least I think that's the case.