error code 29 on backup operation

Running Netvault with same client. Server and client are on different subnets. Client is rhel 6.9, client firewall is off, selinux is currently permissive.

Service starts/stops fine. Client can be added to netvault. Firewall and access checks both pass. Everything is good, but 2 parts. I cannot change settings for the client in netvault such as checking "client is outside firewall, or port ranges", and backup attempts fail with

Failed to open a RDA connection to ''. Error Code 29. 'Operation timedout'

Ideas? I had before and that did not work either. I have other clients, also on different subnets from the netvault appliance, they work fine.

Selinux shouldn't need to be off, does it? Only thing I can think of is the network firewall might be blocking something. What ports should be opened for this to work?