1st thing I'd check, since this is a Windows box, and you've already thought of the other two FW's in the path of the data, is to check that the actual Windows firewall itself isn't on. It's easily overlooked.
Then on the Windows server you've installed the Forwarder on, you should be able to just open
c:\program files\splunkuniveralforwarder\etc\system\local\outputs.conf
which should read similar to this:
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
server = splunk.index.ip:port (default is 9997, looks like you used 4990 based on you're SW FW log above)
[tcpout-server://splunk.index.server.ip:port]
Then, on the main receiving Splunk Indexer:
Go into Manager > Data/Forwarding and Receiving > Configure Receiving > Add New
Then tell Splunk what port to listen on, in this case I assume 4490.
If you review these items you should start seeing your indexed count go up.
For reference here's the UF docs:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Deploymentoverview
http://docs.splunk.com/Documentation/Splunk/5.0.2/Deploy/Introducingtheuniversalforwarder
... View more