Locking down DFS replication to a single port can be done. You can perform the following on both the source and destination server as both need to be configured assuming two-way replication else they will be talking different ports depending on which way the replication is running from:

C:\dfsrdiag staticrpc /port:XXXX /member:YYYY

Icon

Do note the following when running the command above:

1. This assumes you ahve installed DFS on the target box
   
2. XXXX - A static port that should be above 1024/TCP should be used
   
3. YYYY - NetBIOS/DNS name of the server requiring the setup. If not specified this assumes the local host will be used

However, there are other ports that are used as part of the overall service. Yu can review the following external link for more information on this all.

http://blogs.technet.com/b/askds/archive/2009/07/16/configuring-dfsr-to-a-static-port-the-rest-of-the-story.aspx