Forward the following ports to the machine that you are hosting the CS server on: 27005, 270015. 27005 is for the "heatbeat" to the auth servers so they know you are public (not necessary if you don't want a public server). 27015 is the default port for the HLDS server.
I forward 27000-27016 to be 100% safe.
vash