It looks like Hazelcast uses multicast address 224.2.2.3 on UDP port 54327 (by default) for discovery, and then port 5701 for TCP communication. Opening UDP port 54327 in the firewall fixed discovery for me. (I had also opened TCP port 5701 but that was not sufficient.)