Connections from kafka consumer

I have few questions regarding Kafka Consumer.

In kafka properties we only mention the zookeeper ip's to connect to.
But I assume the consumer also connects to Kafka broker for actually
consuming the messages.

We have firewall enabled on ports, so in order to connect from my consumer
I need to open port for both zookeeper and kafka. Is my assumption correct?

Also does the consumer also connects on the broker port (which is 9092 by
default)?