Why not add a --open-firewall-ports option and let the user decide? Maybe print a warning without that option if the port is not open if you really want to make it easy.

Haha yes of course it's easier for developers, but they write the software that I have to deploy and manage on my server!