UPDATE 1:
According to this tutorial on Using PayPal\'s Instant Payment Notification with PHP, PayPal cannot access locally hosted websites unless c
It should work without a problem, however it might get picky if you send in "invalid URLs" for return urls and IPN message urls. Meaning, sending in http://localhost/cancelpaypal.php as cancelURL might tell you that it is an invalid url.
I do however don't think it should.
Having to open up router ports would only be needed for IPN, because the redirect in the normal flow is a regular "Location:" header hence it is your browser that needs to be able to access the site (localhost)