Most trojans and other malicious programs infect a users machine through lower port numbers. It's usually recommened to forward the higher, unregistered port range, 49152 to 65535.