That'll depend on your configuration, but examples would be 5060 + 5080 for SIP, 8021 for ESL etc.
You'll want to give the VM access to the Internet via NAT. RTP ports are assigned randomly (in a very wide port range). A stateful NAT should see the SIP SDP packets going through it and automatically open the RTP port mappings. That will *only* work if you're not using TLS, since for obvious reasons you can't read the SDP otherwise.
If you are using TLS you could port forward an entire port range. You can manually set the port range RTP will use in switch.conf.xml.
The SIP packets will want to include in the SDP the external IP where clients can send packets to. That's probably the IP of the Windows server. You can set it manually on the sofia profile(s) using ext-sip-ip and ext-rtp-ip, or use STUN.
If you're going through multiple layers of NAT (ie the Windows server does not have a public IP) that can complicate matters.