I'm currently investigating the possibility that setting the following registry values may open the ports:

first query Software\Microsoft\MSSQLServer\MSSQLServer\SuperSocketNetLib\Tcp
value TcpPort for the actual TCP port
If named instance, query
Software\Microsoft\Microsoft SQL Server\(InstanceName)\MSSQLServer\SuperSocketNetLib\Tcp
value TcpPort for the actual TCP port

Then create the key values below, substituting the actual TCP port number for 1433 in all the names and data below
* HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\ Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List
* Name : 1434:UDP
* Type : REG_SZ
* Data : 1434:UDP:*:Enabled:PPS EE UDP
* HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\ Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List
* Name : 1433:TCP
* Type : REG_SZ
* Data : 1433:TCP:*:Enabled:PPS EE TCP
* HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\ Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List
* Name : 1434:UDP
* Type : REG_SZ
* Data : 1434:UDP:*:Enabled:PPS EE UDP
* HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\ Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List
* Name : 1433:TCP
* Type : REG_SZ
* Data : 1433:TCP:*:Enabled:PPS EE TCP
* HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\ Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List
* Name : 1434:UDP
* Type : REG_SZ
* Data : 1434:UDP:*:Enabled:PPS EE UDP
* HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\ Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List
* Name : 1433:TCP
* Type : REG_SZ
* Data : 1433:TCP:*:Enabled:PPS EE TCP

I'll report results in a day or two.