assuming it runs over the default RDP port, 3389, then i don't see why you'd have to open any ports. you'd have to be running MDS. basically, it would appear that the BES was attempting an RDP session to an internal machine, so if you could RDP to another internal machine from the BES, then you should be able to from the handheld. of course, if it runs on another port, or if you are attempting a connection to an internal machine without having MDS enabled, or if you are attempting a connection to a machine not on the internal network, then this would not apply.