Sharded Mongodb Communication
The TL;DR versions:

You should assume that all mongod processes (including config servers) and all mongos processes need to talk to each other.  Naturally, this only applies to the actual database port (27017 default) and not the HTTP console (+1000) or REST if you have that enabled.

More verbosely:

The mongos will need to talk to every member of each shard (usually a replica set) for reads and writes.  The mongos also need to talk to the config servers - that is where it gets its config from, and how it does locking, keeps admin users and more. 

The members of a replica set all need to talk to each other (replication/elections).  All primaries need to talk to the config servers as well as to other primaries in other shards.  Since all secondaries can become primary, then they all should have the same ports open as the primaries.

Also, make sure the permissions are bi-directional, without going into a lot of details, the origin of connections often surprises people (pull versus push in chunk migrations for example).

In fact, the only processes I can think of that you may get away with restricting ports on are the Arbiters - they will only need to be able to talk to the members of the set and can never become primary.  However, the mongos does ping it as part of a health check thread, so in the end I think the simplicity of a policy to cover all would be more benefit than the couple of ports you can omit for the arbiter special case.