I host a 70cm echolink node and did not need to place
that PC in the DMZ.
I did need to forward UDP ports 5198 and 5199 to the
PC running echolink. I don't
remember whether I also forwarded TCP port 5200 or whether that "looked after
itself".
You are right, only forwarding 5198 and 5199 UDP is sufficient.
The echolink program also makes outgoing connects to port 5200 on the central server but
you
normally don't need to open or forward anything for that, it is just the normal
outgoing NAT.
(there are instructions that mistakenly mention port 5200 to be opened, but the program is
not
even listening on that)
Rob