They do not need to be but if they are then most likely static routes will need to be configured.  The console IP needs to know how to route back out.  I suspect your Default Gateway is on the HTTP port.  This is a common issue since the linux guest has two IP's and only one default gateway.

TCP Routing really, it has nothing to do with vCD.  Most likely the browser is getting to the vmrc port but that interface has no route back to the client.

Or

The cell cannot route to and from the ESXi host on the VMRC proxy port, either way could be a routing problem. Bottom line check the connectivity from your client to the VMRC port, AND check the cells connectivity to the ESXi host(s).  Since it is a proxy it has to have proper communication on both ends.  Also check DNS resolution on the cell itself.

yes the client's browser needs to be able to connect to the console proxy IP and the cell in turn needs to have direct access to the ESXi hosts.  You need to verify connectivity from client to cell Console IP and from cell to ESXi.  I am sure you are missing a static route on the cell or there is some other routing issue.  the Cell is a middle man between client console and ESXi so it makes sense you have to have end to end connectivity.