DB server 主机防火墙开设端口1521（Oracle监听端口），外网应用服务器程序仍然不能访问数据库。
原因
For windows platform, the listener spawns a thread when accept an incoming SQL*Net connection and it will listen to a random free port other than the listener port. The connection is redirected to different port, so if the firewall just opens a single port it will not work。
解决方案
To workaround this, we can set a Windows registry value USE_SHARED_SOCKET, put this registry key under your ORACLE registry:HKEY_LOCAL_MACHINESOFTWAREORACLEHOME<#>
Create the key USE_SHARED_SOCKET and assign the value TRUE.
After that you need to restart the Oracle service and also the Oracle listener, then it should work.
One problem of this setting is if your listener is down, all the connections will be cut. This is different than Oracle on Unix platform works.
补充：如果Oracle安装在UNIX平台下面，则防火墙只需要开设一个端口（同Oracle监听端口）