Think about FTP. Client is behind NAT, so needs to use PASV mode (server opens arbitrary data port for client to connect to, instead of server connecting to arb

Think about FTP. Client is behind NAT, so needs to use PASV mode (server opens arbitrary data port for client to connect to, instead of server connecting to arbitrary data port on client). If the server has a firewall that blocks all inbound but 21/tcp, or is behind NAT with just 21/tcp forwarded, no data transfers are possible. These are totally different setups from a network operations point of view, but look identical from application and user point of view. I think this is what the parent was getting at: both setups effectivity prevent a user from accepting arbitrary inbound connections to their machine.