Answer
It depends on which of the two you're actually using, since a given deployment typically uses one or the other, not both. If you're using the (now-retired) Touch Apps Cloud service, your on-premise Uplink component is what needs to reach IFS's hosted cloud endpoint, and that hosted endpoint in turn needs to reach back to your Uplink — in this setup, individual mobile devices/apps only need to reach the hosted cloud endpoint, not your infrastructure directly. If instead you're running an on-premise Touch App Server (TAS), there's no Uplink involved at all — every mobile device and app needs direct network access to reach your TAS instead. Knowing which of the two you're actually running determines which firewall rule you actually need.