There are several instances where Salesforce calls into (consumes) an S4S web service hosted on the Sitecore server. Typically this happens when a Salesforce operator clicks on a Sitecore related button. Examples are the "Get Sitecore Analytics" and "Get Sitecore Page Visits" buttons. These examples are associated with the S4S Analytics functionality in Salesforce.

If the button functionality fails, it is likely the problem will be network related.

• If the Sitecore instance is behind a firewall, your network administrator will have to create a rule allowing callouts from Salesforce. In our experience, the number of IP addresses that these callouts originate from is very limited, most likely one of two possible IP addresses, depending on region and POD of your Salesforce org. 
• The best place to determine the SF address(es) is by examining firewall logs or, if traffic is getting through to IIS, through the IIS logs. 

The IIS log entries above are an example of a successful callout from Salesforce at IP 182.50.78.8 to the local instance of Sitecore. In this case, from APNIC region. When the Salesforce to Sitecore callout is successful, these lines in the IIS log are generated immediately after initiating a Sitecore related button click action in Salesforce.

You can confirm Salesforce IP addresses against their lists here.  We have found that only a very small subset of these IP address ranges are used for SFDC callouts, and we suggest using rules only for the specific IPs being used in your implementation.