What? I'm not sure I'm following. You just install Tor and configure bitcoind to use it. Then bitcoind will automatically create .onion service for your node, where other Tor enabled nodes will be able to connect to, and you will be able to connect to other Tor nodes (or clearnet nodes via Tor using exit nodes). No firewall configuration is needed for that, unless you have some strict rules that prohibits encrypted outgoing traffic to tcp/443, which Tor uses (to look like a HTTPS traffic).